@opengeni/core 0.12.5 → 0.12.10

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import { Settings } from '@opengeni/config';
-import { ScheduledTask, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiator, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, SessionSpawnDenial, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, SessionSkill, TurnExecutionPolicyV1, GoalSpec, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionToolPolicyRequest, ConnectionMetadata, OpenGeniSlackBotConnectionMetadata, WorkspaceMember, NewSessionDraft, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
+import { ScheduledTask, TurnInitiator, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, SessionSpawnDenial, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, SessionSkill, TurnExecutionPolicyV1, GoalSpec, FirstPartyMcpToolName, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionToolPolicyRequest, ConnectionMetadata, OpenGeniSlackBotConnectionMetadata, WorkspaceMember, NewSessionDraft, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
 export { mergeToolRefs, stableJson } from '@opengeni/contracts';
 import * as _opengeni_db from '@opengeni/db';
-import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, SessionCommandActor, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput, ConnectionMetadataWithVerification } from '@opengeni/db';
+import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, SessionCommandActor, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput, ConnectionMetadataWithVerification, SessionCommandReceiptRow } from '@opengeni/db';
 import { DocumentServices } from '@opengeni/documents';
 import { EventBus } from '@opengeni/events';
 import { Observability } from '@opengeni/observability';
@@ -106,8 +106,9 @@ type SessionWorkflowClient = {
     }) => Promise<void>;
     triggerScheduledTask: (input: {
         task: ScheduledTask;
-        agentRunUsageIdempotencyKey?: string;
-        triggerWorkflowId?: string;
+        agentRunUsageIdempotencyKey: string;
+        triggerWorkflowId: string;
+        initiator: TurnInitiator;
     }) => Promise<void>;
     startRigVerification: (input: {
         workspaceId: string;
@@ -534,6 +535,13 @@ declare function disableCapability(input: {
     capabilityId: string;
 }): Promise<CapabilityInstallation>;
 declare function settingsWithEnabledCapabilityMcpServers(db: Database, workspaceId: string, settings: Settings): Promise<Settings>;
+/**
+ * Register Codex Apps as an optional runtime MCP when the deployment enables
+ * it. Registration only makes the server selectable; the session tool policy
+ * decides whether the model sees it, and Codex credential resolution
+ * independently decides whether calls can authenticate.
+ */
+declare function settingsWithCodexAppsMcpServer(settings: Settings): Settings;
 declare function settingsWithMcpCapabilityServers(settings: Settings, enabled: EnabledMcpCapabilityServer[]): Settings;
 declare function discoverMcpRegistryCapabilities(input: {
     query?: string;
@@ -691,11 +699,8 @@ type ResolvedSessionToolPolicy = {
     effectivePolicy: SessionEffectiveToolPolicy;
 };
 type SessionToolPolicyInput = {
-    toolPolicy?: SessionToolPolicy | null;
+    toolPolicy: SessionToolPolicy;
     sessionTools: ToolRef[];
-    turnTools?: ToolRef[];
-    /** Undefined preserves the legacy merge path for pre-provenance callers. */
-    turnToolsProvided?: boolean;
     availableMcpServerIds: Iterable<string>;
     /** Current omitted-tools defaults, intentionally narrower than all servers. */
     defaultMcpServerIds?: Iterable<string>;
@@ -795,6 +800,13 @@ declare class SessionSpawnDeniedError extends Error {
     readonly denial: SessionSpawnDenial;
     constructor(denial: SessionSpawnDenial);
 }
+/**
+ * Resolve per-session first-party tool visibility without consulting
+ * authorization. Top-level omission uses the minimal runtime default (stored
+ * as null); child omission snapshots the parent's exact effective selection.
+ * Explicit [] is authoritative and must never widen.
+ */
+declare function resolveFirstPartyMcpToolsForCreate(requested: FirstPartyMcpToolName[] | undefined, parentStored: FirstPartyMcpToolName[] | null | undefined): FirstPartyMcpToolName[];
 declare function sessionSpawnDenialEnvelope(error: SessionSpawnDeniedError): {
     readonly error: {
         readonly code: "nested_agent_depth_exceeded" | "nested_agent_depth_override_forbidden";
@@ -833,7 +845,7 @@ declare function createAndStartSession(input: {
     resources: ResourceRef[];
     skills?: SessionSkill[];
     tools: ToolRef[];
-    toolPolicy?: SessionToolPolicy;
+    toolPolicy: SessionToolPolicy;
     clientEventId?: string;
     model: string;
     reasoningEffort: Settings["openaiReasoningEffort"];
@@ -854,6 +866,7 @@ declare function createAndStartSession(input: {
     goal?: GoalSpec | null;
     instructions?: string | null;
     firstPartyMcpPermissions?: Permission[] | null;
+    firstPartyMcpTools: FirstPartyMcpToolName[];
     mcpServers?: CreateSessionMcpServerInput[];
     sessionMcpServers?: SessionMcpServerMetadata[];
     parentSessionId?: string | null;
@@ -924,8 +937,6 @@ declare function postUserMessageTurn(input: {
     text: string;
     turnInstructions?: string | null;
     resources: ResourceRef[];
-    tools: ToolRef[];
-    toolsProvided: boolean;
     model?: string | null;
     reasoningEffort?: Settings["openaiReasoningEffort"] | null;
     clientEventId?: string;
@@ -958,15 +969,12 @@ declare function createSessionForRequest(deps: ApiRouteDeps, grant: AccessGrant,
  * `POST /sessions/:id/events` and the first-party MCP `session_send_message`
  * tool: resource/tool validation, usage limits, the locked append + turn
  * enqueue, and usage recording. `toolsProvided: false` durably preserves an
- * absent `tools` key so execution inherits the session policy; an explicit
- * empty array is a deliberate per-turn narrowing.
+ * Tool selection is durable session state and never rides a follow-up prompt.
  */
 declare function acceptSessionUserMessage(deps: AcceptSessionUserMessageDependencies, grant: AccessGrant, workspaceId: string, sessionId: string, input: {
     text: string;
     turnInstructions?: string | null;
     resources?: ResourceRef[];
-    tools?: ToolRef[];
-    toolsProvided: boolean;
     model?: string | null;
     reasoningEffort?: ReasoningEffort | null;
     clientEventId?: string;
@@ -1091,6 +1099,8 @@ type HumanSessionCommandContext = {
     workspaceId: string;
     sessionId: string;
     subjectId: string;
+    /** See AgentSessionCommandContext.authorizationSurface. */
+    authorizationSurface?: SessionAuthorizationSurface;
 };
 type AgentSessionCommandContext = {
     accountId: string;
@@ -1100,6 +1110,13 @@ type AgentSessionCommandContext = {
     callerTurnId: string;
     callerAttemptId: string;
     callerExecutionGeneration: number;
+    /**
+     * The trusted adapter surface that owns this command's one authorization
+     * decision. Direct core callers omit it and retain the canonical `core`
+     * surface; adapters that delegate the complete command set it explicitly so
+     * they do not authorize once at the edge and then repeat the host call here.
+     */
+    authorizationSurface?: SessionAuthorizationSurface;
 };
 type SessionAuthorizationCommandDeps = {
     db: Database;
@@ -1135,7 +1152,16 @@ declare function controlAgentSessionWorkstream(deps: {
     action: "pause" | "resume";
     idempotencyKey: string;
     reason?: string | null;
-}): Promise<_opengeni_db.SessionControlMutationResult>;
+}): Promise<{
+    authorization: ResolvedSessionAuthorization | null;
+    receipt: SessionCommandReceiptRow;
+    control: _opengeni_db.EffectiveSessionControl;
+    sessionControlEventId: string;
+    workspaceControlEventId: string;
+    interruptionCount: number;
+    wakeCount: number;
+    replay: boolean;
+}>;
 declare function moveHumanQueuePrompt(deps: {
     db: Database;
     bus: EventBus;
@@ -1170,4 +1196,4 @@ declare function controlHumanWorkspace(deps: {
 declare function getHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext): Promise<ComposerDraft>;
 declare function saveHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext, input: SaveComposerDraftRequest): Promise<ComposerDraft>;
 
-export { type AcceptSessionUserMessageDependencies, type AccessDeps, type AgentSessionCommandContext, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetReadinessHold, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type HumanSessionCommandContext, type LimitCheckInput, type LimitDependencies, MARKETING_SOCIAL_PACK_ID, MAX_CHECKS_PER_RIG, MAX_CREDENTIAL_HOOKS_PER_RIG, MAX_DEFAULT_VARIABLE_SETS_PER_RIG, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_RIGS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResolvedSessionAuthorization, type ResolvedSessionToolPolicy, type ResumeBoxByIdInput, type ResumedSandboxSession, type RigServices, type RigVerificationClassification, type RunOnOp, type RunOnResult, SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID, SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, SessionAuthorizationDeniedError, type SessionAuthorizationDependencies, SessionAuthorizationUnavailableError, SessionSpawnDeniedError, type SessionToolPolicyInput, type SessionWorkflowClient, acceptSessionUserMessage, activateRigVersionForApi, appendRigSetupCommand, applyCapabilityEnablement, assertAllowedEnvironmentVariableName, assertAllowedVariableSetVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertToolRefsSubset, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, assertWorkspaceModelPolicyAllows, availableToolRefs, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, canonicalConfiguredModel, checkLimit, classifyRigVerificationOutcome, controlAgentSessionWorkstream, controlHumanSessionWorkstream, controlHumanWorkspace, createAndStartSession, createCatalogItem, createRigForApi, createRigVersionForApi, createSessionForRequest, createValidatedScheduledTask, deleteHumanQueuePrompt, deleteRigForApi, disableCapability, discoverMcpRegistryCapabilities, editHumanQueuePrompt, enableCapability, enabledCapabilityMcpToolRefs, getActorNewSessionDraft, getCapabilityPack, getHumanComposerDraft, hasPermission, hasReservedOpenGeniSlackBotMetadata, hasReservedOpenGeniSlackBotSessionMetadata, isAuthoritativeGitHubRepositorySelectionError, isBuiltInCapabilityPack, isOpenGeniSlackBotConnection, isTrustedScheduledSlackBotSession, isUserMember, listCapabilityPacks, listFleet, listRigChangesForApi, listRigVersionsForApi, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, moveHumanQueuePrompt, normalizeResources, officialMcpRegistryUrl, openGeniSlackBotMetadata, postUserMessageTurn, promoteSetupAppendChange, promoteVerifiedDefinitionEditChangeForApi, proposeRigChangeForApi, provisionSandbox, readSessionLineage, reasoningEffortForSession, recordRigAuditEvent, recordVariableSetAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireLimit, requireOpenGeniSlackBotConnection, requirePermission, requireQueuedTurnForApi, requireRigChangeForApi, requireRigForApi, requireScheduledTaskForApi, requireSessionAuthorization, requireSessionAuthorizationListScope, requireVariableSetEncryption, requireVariableSetForApi, resolveCapabilityPack, resolveMemberSubjectId, resolveSessionToolPolicy, restoreScheduledTask, rigActorForGrant, routingEnabled, runOnSandbox, saveActorNewSessionDraft, saveHumanComposerDraft, scheduledSlackBotConnectionId, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, sendAgentSessionMessage, sessionSpawnDenialEnvelope, sessionToolPolicyAllowsDefaultNativeTools, sessionWithEffectiveToolPolicy, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, settingsWithSessionMcpServerMetadata, steerAgentSession, steerHumanQueuePrompt, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateRigForApi, updateSessionMcpApprovalPolicy, updateSessionTitle, updateSessionToolPolicy, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateMcpCapabilityConnection, validateOpenGeniSlackBotConnectionSelection, validateToolRefs, validateToolRefsForSessionPolicy, validateVariableSetAttachment, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, workspaceSessionToolPolicyDefaultServerIds, workspaceSessionToolPolicyServerIds, wrapChannelABoxWithRouting };
+export { type AcceptSessionUserMessageDependencies, type AccessDeps, type AgentSessionCommandContext, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetReadinessHold, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type HumanSessionCommandContext, type LimitCheckInput, type LimitDependencies, MARKETING_SOCIAL_PACK_ID, MAX_CHECKS_PER_RIG, MAX_CREDENTIAL_HOOKS_PER_RIG, MAX_DEFAULT_VARIABLE_SETS_PER_RIG, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_RIGS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResolvedSessionAuthorization, type ResolvedSessionToolPolicy, type ResumeBoxByIdInput, type ResumedSandboxSession, type RigServices, type RigVerificationClassification, type RunOnOp, type RunOnResult, SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID, SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, SessionAuthorizationDeniedError, type SessionAuthorizationDependencies, SessionAuthorizationUnavailableError, SessionSpawnDeniedError, type SessionToolPolicyInput, type SessionWorkflowClient, acceptSessionUserMessage, activateRigVersionForApi, appendRigSetupCommand, applyCapabilityEnablement, assertAllowedEnvironmentVariableName, assertAllowedVariableSetVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertToolRefsSubset, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, assertWorkspaceModelPolicyAllows, availableToolRefs, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, canonicalConfiguredModel, checkLimit, classifyRigVerificationOutcome, controlAgentSessionWorkstream, controlHumanSessionWorkstream, controlHumanWorkspace, createAndStartSession, createCatalogItem, createRigForApi, createRigVersionForApi, createSessionForRequest, createValidatedScheduledTask, deleteHumanQueuePrompt, deleteRigForApi, disableCapability, discoverMcpRegistryCapabilities, editHumanQueuePrompt, enableCapability, enabledCapabilityMcpToolRefs, getActorNewSessionDraft, getCapabilityPack, getHumanComposerDraft, hasPermission, hasReservedOpenGeniSlackBotMetadata, hasReservedOpenGeniSlackBotSessionMetadata, isAuthoritativeGitHubRepositorySelectionError, isBuiltInCapabilityPack, isOpenGeniSlackBotConnection, isTrustedScheduledSlackBotSession, isUserMember, listCapabilityPacks, listFleet, listRigChangesForApi, listRigVersionsForApi, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, moveHumanQueuePrompt, normalizeResources, officialMcpRegistryUrl, openGeniSlackBotMetadata, postUserMessageTurn, promoteSetupAppendChange, promoteVerifiedDefinitionEditChangeForApi, proposeRigChangeForApi, provisionSandbox, readSessionLineage, reasoningEffortForSession, recordRigAuditEvent, recordVariableSetAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireLimit, requireOpenGeniSlackBotConnection, requirePermission, requireQueuedTurnForApi, requireRigChangeForApi, requireRigForApi, requireScheduledTaskForApi, requireSessionAuthorization, requireSessionAuthorizationListScope, requireVariableSetEncryption, requireVariableSetForApi, resolveCapabilityPack, resolveFirstPartyMcpToolsForCreate, resolveMemberSubjectId, resolveSessionToolPolicy, restoreScheduledTask, rigActorForGrant, routingEnabled, runOnSandbox, saveActorNewSessionDraft, saveHumanComposerDraft, scheduledSlackBotConnectionId, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, sendAgentSessionMessage, sessionSpawnDenialEnvelope, sessionToolPolicyAllowsDefaultNativeTools, sessionWithEffectiveToolPolicy, settingsWithCodexAppsMcpServer, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, settingsWithSessionMcpServerMetadata, steerAgentSession, steerHumanQueuePrompt, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateRigForApi, updateSessionMcpApprovalPolicy, updateSessionTitle, updateSessionToolPolicy, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateMcpCapabilityConnection, validateOpenGeniSlackBotConnectionSelection, validateToolRefs, validateToolRefsForSessionPolicy, validateVariableSetAttachment, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, workspaceSessionToolPolicyDefaultServerIds, workspaceSessionToolPolicyServerIds, wrapChannelABoxWithRouting };

package/dist/index.js

@@ -829,6 +829,7 @@ async function delegatedAccessContext(c, deps, mode, token = bearerToken(c)) {
         metadata: {
           delegated: true,
           ...payload.sessionId ? { sessionId: payload.sessionId } : {},
+          ...payload.firstPartyMcpTools !== void 0 ? { firstPartyMcpTools: payload.firstPartyMcpTools } : {},
           // Caller identity: the turn that minted this token. Tools classify the
           // CALLER from this instead of re-reading the live active pointer.
           ...payload.turnId ? { turnId: payload.turnId } : {},
@@ -1189,6 +1190,12 @@ import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } fro
 import {
   CapabilityCatalogItem
 } from "@opengeni/contracts";
+import {
+  CODEX_APPS_MCP_SERVER_ID,
+  CODEX_APPS_MCP_SERVER_NAME,
+  CODEX_APPS_MCP_URL,
+  CODEX_APPS_STARTUP_TIMEOUT_MS
+} from "@opengeni/codex";
 import {
   decryptVariableSetValue,
   decryptedCapabilityHeaders,
@@ -2029,7 +2036,26 @@ async function disableCapability(input) {
 }
 async function settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings) {
   const enabled = await listEnabledMcpCapabilityServers(db, workspaceId);
-  return settingsWithMcpCapabilityServers(settings, enabled);
+  return settingsWithCodexAppsMcpServer(settingsWithMcpCapabilityServers(settings, enabled));
+}
+function settingsWithCodexAppsMcpServer(settings) {
+  if (!settings.codexConnectedAppsEnabled || settings.mcpServers.some((server) => server.id === CODEX_APPS_MCP_SERVER_ID)) {
+    return settings;
+  }
+  return {
+    ...settings,
+    mcpServers: [
+      ...settings.mcpServers,
+      {
+        id: CODEX_APPS_MCP_SERVER_ID,
+        name: CODEX_APPS_MCP_SERVER_NAME,
+        url: CODEX_APPS_MCP_URL,
+        timeoutMs: CODEX_APPS_STARTUP_TIMEOUT_MS,
+        // Availability is credential-specific, so discover on every run.
+        cacheToolsList: false
+      }
+    ]
+  };
 }
 function settingsWithMcpCapabilityServers(settings, enabled) {
   if (enabled.length === 0) {
@@ -3225,15 +3251,15 @@ function projectIds(ids) {
   };
 }
 function resolveSessionToolPolicy(input) {
-  const policy = input.toolPolicy ?? { mode: "legacy", inheritedFromSessionId: null };
+  const policy = input.toolPolicy;
   const availableIds = new Set(input.availableMcpServerIds);
   const defaultIds = new Set(input.defaultMcpServerIds ?? []);
   const mandatoryIds = MANDATORY_SESSION_MCP_SERVER_IDS.filter(
     (id) => availableIds.has(id)
   );
   const mandatoryIdSet = new Set(mandatoryIds);
-  const selectedRefs = input.turnToolsProvided === true ? mergeToolRefs2([], input.turnTools ?? []) : input.turnToolsProvided === false ? mergeToolRefs2([], input.sessionTools) : mergeToolRefs2(input.sessionTools, input.turnTools ?? []);
-  const tracksWorkspaceDefaults = policy.mode === "workspace_default" && input.turnToolsProvided !== true;
+  const selectedRefs = mergeToolRefs2([], input.sessionTools);
+  const tracksWorkspaceDefaults = policy.mode === "workspace_default";
   let toolRefs = selectedRefs.filter((tool) => tool.optional !== true || availableIds.has(tool.id));
   if (tracksWorkspaceDefaults) {
     toolRefs = mergeToolRefs2(
@@ -3319,7 +3345,7 @@ function sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDe
   return {
     ...session,
     effectiveToolPolicy: resolveSessionToolPolicy({
-      ...session.toolPolicy ? { toolPolicy: session.toolPolicy } : {},
+      toolPolicy: session.toolPolicy,
       sessionTools: session.tools,
       availableMcpServerIds: availableIds,
       defaultMcpServerIds: workspaceDefaultServerIds
@@ -3351,6 +3377,8 @@ import {
 import {
   CreateSessionRequest,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  DEFAULT_FIRST_PARTY_MCP_TOOLS,
+  FIRST_PARTY_MCP_TOOL_NAMES,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY as OPENGENI_SLACK_BOT_SESSION_METADATA_KEY2,
   SessionSpawnDenial,
   ServiceTurnInitiator,
@@ -3473,6 +3501,11 @@ var SessionSpawnDeniedError = class extends Error {
     this.denial = denial;
   }
 };
+function resolveFirstPartyMcpToolsForCreate(requested, parentStored) {
+  if (requested !== void 0) return [...requested];
+  if (parentStored === void 0) return [...DEFAULT_FIRST_PARTY_MCP_TOOLS];
+  return [...parentStored ?? DEFAULT_FIRST_PARTY_MCP_TOOLS];
+}
 function sessionSpawnDeniedMessage(denial) {
   if (denial.code === "nested_agent_depth_override_forbidden") {
     return `requested nested-agent depth limit ${denial.requestedMaxNestedAgentDepthOverride ?? "unknown"} exceeds inherited limit ${denial.effectiveMaxNestedAgentDepth}; workspace:admin is required to increase it`;
@@ -3766,7 +3799,7 @@ async function createAndStartSession(input) {
       resources: input.resources,
       skills: input.skills ?? [],
       tools: input.tools,
-      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
+      toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
       ...input.createdBy ? { createdBy: input.createdBy } : {},
       ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
@@ -3777,6 +3810,7 @@ async function createAndStartSession(input) {
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey: input.createIdempotencyKey,
@@ -3810,7 +3844,7 @@ async function createAndStartSession(input) {
       resources: input.resources,
       skills: input.skills ?? [],
       tools: input.tools,
-      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
+      toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
       ...input.createdBy ? { createdBy: input.createdBy } : {},
       ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
@@ -3821,6 +3855,7 @@ async function createAndStartSession(input) {
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       sandboxGroupId: input.sandboxGroupId ?? null,
@@ -3874,7 +3909,7 @@ async function finishStartSession(input, session) {
     reasoningEffortFallback: input.reasoningEffort,
     turnExecutionPolicy: input.turnExecutionPolicy,
     createdEventPayload: {
-      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
+      toolPolicy: input.toolPolicy,
       ...input.variableSet ? { variableSetId: input.variableSet.id, variableSetName: input.variableSet.name } : {},
       ...input.sessionMcpServers?.length ? { mcpServers: input.sessionMcpServers } : {}
     },
@@ -3987,8 +4022,6 @@ async function postUserMessageTurn(input) {
           text: input.text,
           turnInstructions: input.turnInstructions ?? null,
           resources: input.resources,
-          tools: input.tools,
-          toolsProvided: input.toolsProvided,
           model: requestedModel,
           reasoningEffort: requestedReasoningEffort,
           reasoningEffortFallback: input.reasoningEffortFallback ?? settings.openaiReasoningEffort,
@@ -4216,6 +4249,20 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       message: "goal-bearing sessions require goals:manage in the resulting first-party MCP permission set"
     });
   }
+  const firstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(
+    payload.firstPartyMcpTools,
+    parentSession ? parentSession.firstPartyMcpTools : void 0
+  );
+  if (payload.goal) {
+    const missingGoalTools = ["goal_update", "goal_complete", "goal_pause"].filter(
+      (name) => !firstPartyMcpTools.includes(name)
+    );
+    if (missingGoalTools.length > 0) {
+      throw new HTTPException10(422, {
+        message: `goal-bearing sessions require first-party MCP tools: ${missingGoalTools.join(", ")}`
+      });
+    }
+  }
   const sandboxChoice = payload.sandbox ?? (parentSessionId ? "shared" : "new");
   let sandboxGroupId = null;
   let inheritedBackend;
@@ -4362,6 +4409,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       // time. Not surfaced as an event.
       instructions: payload.instructions ?? null,
       firstPartyMcpPermissions,
+      firstPartyMcpTools,
       mcpServers: sessionMcpServers.dbServers,
       sessionMcpServers: sessionMcpServers.metadata,
       parentSessionId,
@@ -4408,22 +4456,12 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   return session;
 }
 async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, input) {
-  if (input.toolsProvided && !deps.settings.sessionTurnToolReplacementEnabled) {
-    throw new HTTPException10(503, {
-      message: "explicit follow-up tool replacement is temporarily unavailable until provenance-aware turn workers finish rolling out; omit tools to inherit the session policy and retry"
-    });
-  }
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   await requireSessionAuthorization(deps, grant, {
     sessionId,
     operation: input.delivery === "steer" ? "session.steer" : "session.append",
     surface: "core"
   });
-  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
-    db,
-    workspaceId,
-    settings
-  );
   const existingSession = await requireSession2(db, workspaceId, sessionId);
   const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
   const effectiveModel = canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;
@@ -4442,27 +4480,7 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     reasoningEffort: effectiveReasoningEffort,
     reasoningSource: input.reasoningEffort == null ? "session" : "explicit"
   });
-  const runtimeSettings = settingsWithSessionMcpServerMetadata(
-    capabilityRuntimeSettings,
-    existingSession.mcpServers
-  );
   const requestedResources = normalizeResources(input.resources ?? []);
-  const tracksWorkspaceDefaults = existingSession.toolPolicy?.mode === "workspace_default";
-  const sessionPolicyTools = withFirstPartyTools(
-    tracksWorkspaceDefaults ? withDefaultEnabledCapabilityMcpTools(
-      availableToolRefs(existingSession.tools, runtimeSettings),
-      settings,
-      capabilityRuntimeSettings
-    ) : existingSession.tools,
-    runtimeSettings
-  );
-  const validatedTools = input.toolsProvided ? validateToolRefsForSessionPolicy({
-    requested: input.tools ?? [],
-    settings: runtimeSettings,
-    allowedTools: sessionPolicyTools,
-    message: "message tools may only narrow the session tool policy"
-  }) : [];
-  const requestedTools = input.toolsProvided ? validatedTools : [];
   await requireLimit(deps, {
     accountId: grant.accountId,
     workspaceId,
@@ -4496,8 +4514,6 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     text: input.text,
     turnInstructions: input.turnInstructions ?? null,
     resources: requestedResources,
-    tools: requestedTools,
-    toolsProvided: input.toolsProvided,
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
     reasoningEffortFallback: sessionReasoningEffort,
@@ -4604,7 +4620,7 @@ async function updateSessionMcpApprovalPolicy(deps, grant, sessionId, serverId,
     effectiveFrom: "next_attempt"
   };
 }
-function toolPolicyAuditSnapshot(session, tools, policy = session.toolPolicy ?? { mode: "legacy", inheritedFromSessionId: null }) {
+function toolPolicyAuditSnapshot(session, tools, firstPartyMcpTools, policy = session.toolPolicy) {
   const allToolRefs = mergeToolRefs([], tools).sort((left, right) => {
     const leftMandatory = left.kind === "mcp" && left.id === "opengeni";
     const rightMandatory = right.kind === "mcp" && right.id === "opengeni";
@@ -4623,6 +4639,8 @@ function toolPolicyAuditSnapshot(session, tools, policy = session.toolPolicy ??
     toolIds: [...toolRefs].sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`)).map((tool) => tool.id),
     toolRefs,
     toolCount: allToolRefs.length,
+    firstPartyMcpTools: [...firstPartyMcpTools].sort(),
+    firstPartyMcpToolCount: firstPartyMcpTools.length,
     truncated: allToolRefs.length > toolRefs.length
   };
 }
@@ -4656,10 +4674,12 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
     }
     return withFirstPartyTools(validatedTools, runtimeSettings);
   })() : null;
+  const explicitRequestedFirstPartyTools = explicitRequest ? [...explicitRequest.firstPartyMcpTools] : null;
   const workspaceDefaultTools = withFirstPartyTools(
     withDefaultEnabledCapabilityMcpTools([], deps.settings, capabilityRuntimeSettings),
     runtimeSettings
   );
+  const workspaceDefaultFirstPartyTools = [...FIRST_PARTY_MCP_TOOL_NAMES];
   const events = await appendSessionEventsWithLockedSessionUpdate(
     deps.db,
     grant.workspaceId,
@@ -4670,6 +4690,7 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
         throw new SessionToolPolicyVersionConflictError(currentVersion);
       }
       let nextTools;
+      let nextFirstPartyMcpTools;
       let nextPolicy;
       if (session.parentSessionId) {
         const parent = await context.getLockedSession(session.parentSessionId);
@@ -4685,6 +4706,9 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
           ) : parent.tools,
           runtimeSettings
         );
+        const parentFirstPartyMcpTools = [
+          ...parent.firstPartyMcpTools ?? DEFAULT_FIRST_PARTY_MCP_TOOLS
+        ];
         if (requestedMode === "workspace_default") {
           if (!parentTracksWorkspaceDefaults) {
             throw new HTTPException10(403, {
@@ -4692,6 +4716,7 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
             });
           }
           nextTools = parentEffective;
+          nextFirstPartyMcpTools = parentFirstPartyMcpTools;
           nextPolicy = {
             mode: "workspace_default",
             inheritedFromSessionId: parent.id
@@ -4703,6 +4728,16 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
             parentEffective,
             "session tools may only narrow the parent session tool policy"
           );
+          const parentFirstPartySet = new Set(parentFirstPartyMcpTools);
+          const widenedFirstPartyTool = explicitRequestedFirstPartyTools.find(
+            (tool) => !parentFirstPartySet.has(tool)
+          );
+          if (widenedFirstPartyTool) {
+            throw new HTTPException10(403, {
+              message: `session OpenGeni tools may only narrow the parent policy: ${widenedFirstPartyTool}`
+            });
+          }
+          nextFirstPartyMcpTools = explicitRequestedFirstPartyTools;
           nextPolicy = {
             mode: "explicit",
             inheritedFromSessionId: parent.id
@@ -4710,13 +4745,19 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
         }
       } else {
         nextTools = requestedMode === "workspace_default" ? workspaceDefaultTools : explicitRequestedTools;
+        nextFirstPartyMcpTools = requestedMode === "workspace_default" ? workspaceDefaultFirstPartyTools : explicitRequestedFirstPartyTools;
         nextPolicy = { mode: requestedMode, inheritedFromSessionId: null };
       }
-      const currentPolicy = session.toolPolicy ?? {
-        mode: "legacy",
-        inheritedFromSessionId: null
-      };
-      const unchanged = stableJson2({ tools: session.tools, policy: currentPolicy }) === stableJson2({ tools: nextTools, policy: nextPolicy });
+      const currentPolicy = session.toolPolicy;
+      const unchanged = stableJson2({
+        tools: session.tools,
+        firstPartyMcpTools: session.firstPartyMcpTools ?? DEFAULT_FIRST_PARTY_MCP_TOOLS,
+        policy: currentPolicy
+      }) === stableJson2({
+        tools: nextTools,
+        firstPartyMcpTools: nextFirstPartyMcpTools,
+        policy: nextPolicy
+      });
       if (unchanged) {
         return { events: [] };
       }
@@ -4726,8 +4767,18 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
           {
             type: "session.tool_policy.updated",
             payload: {
-              before: toolPolicyAuditSnapshot(session, session.tools, currentPolicy),
-              after: toolPolicyAuditSnapshot(session, nextTools, nextPolicy),
+              before: toolPolicyAuditSnapshot(
+                session,
+                session.tools,
+                [...session.firstPartyMcpTools ?? DEFAULT_FIRST_PARTY_MCP_TOOLS],
+                currentPolicy
+              ),
+              after: toolPolicyAuditSnapshot(
+                session,
+                nextTools,
+                nextFirstPartyMcpTools,
+                nextPolicy
+              ),
               version: nextVersion,
               effectiveFrom: "next_attempt"
             }
@@ -4735,6 +4786,7 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
         ],
         update: {
           tools: nextTools,
+          firstPartyMcpTools: nextFirstPartyMcpTools,
           toolPolicy: nextPolicy,
           toolPolicyVersion: nextVersion,
           expectedToolPolicyVersion: request.expectedVersion
@@ -5305,14 +5357,14 @@ async function authorizeHumanSessionCommand(deps, context, operation) {
   return await requireSessionAuthorization(deps, humanAccessGrant(context), {
     sessionId: context.sessionId,
     operation,
-    surface: "core"
+    surface: context.authorizationSurface ?? "core"
   });
 }
 async function authorizeAgentSessionCommand(deps, context, targetSessionId, operation) {
   return await requireSessionAuthorization(deps, agentAccessGrant(context), {
     sessionId: targetSessionId,
     operation,
-    surface: "core"
+    surface: context.authorizationSurface ?? "core"
   });
 }
 function agentActor(context) {
@@ -5443,7 +5495,12 @@ async function steerAgentSession(deps, context, input) {
   return result;
 }
 async function controlAgentSessionWorkstream(deps, context, input) {
-  await authorizeAgentSessionCommand(deps, context, input.targetSessionId, "session.control");
+  const authorization = await authorizeAgentSessionCommand(
+    deps,
+    context,
+    input.targetSessionId,
+    "session.control"
+  );
   const result = await withWorkspaceRls(
     deps.db,
     context.workspaceId,
@@ -5464,7 +5521,7 @@ async function controlAgentSessionWorkstream(deps, context, input) {
   ]);
   await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);
   await requestControlWakeDispatch(deps, result.wakeCount);
-  return result;
+  return { ...result, authorization };
 }
 function receipt(row) {
   return {
@@ -5486,8 +5543,6 @@ function composerDraft(row) {
     revision: row.revision,
     text: row.text,
     resources: row.resources,
-    tools: row.tools,
-    toolsProvided: row.toolsProvided,
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     sourceTurnId: row.sourceTurnId,
@@ -5705,8 +5760,6 @@ async function getHumanComposerDraft(deps, context) {
     revision: 0,
     text: "",
     resources: [],
-    tools: [],
-    toolsProvided: false,
     model: session.model,
     reasoningEffort: reasoningEffortForMetadata2(session.metadata, "medium"),
     sourceTurnId: null,
@@ -5832,6 +5885,7 @@ export {
   requireVariableSetEncryption,
   requireVariableSetForApi,
   resolveCapabilityPack,
+  resolveFirstPartyMcpToolsForCreate,
   resolveMemberSubjectId,
   resolveSessionToolPolicy,
   restoreScheduledTask,
@@ -5848,6 +5902,7 @@ export {
   sessionSpawnDenialEnvelope,
   sessionToolPolicyAllowsDefaultNativeTools,
   sessionWithEffectiveToolPolicy,
+  settingsWithCodexAppsMcpServer,
   settingsWithEnabledCapabilityMcpServers,
   settingsWithMcpCapabilityServers,
   settingsWithSessionMcpServerMetadata,