@opengeni/core 0.12.7 → 0.12.10

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import { Settings } from '@opengeni/config';
 import { ScheduledTask, TurnInitiator, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, SessionSpawnDenial, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, SessionSkill, TurnExecutionPolicyV1, GoalSpec, FirstPartyMcpToolName, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionToolPolicyRequest, ConnectionMetadata, OpenGeniSlackBotConnectionMetadata, WorkspaceMember, NewSessionDraft, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
 export { mergeToolRefs, stableJson } from '@opengeni/contracts';
 import * as _opengeni_db from '@opengeni/db';
-import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, SessionCommandActor, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput, ConnectionMetadataWithVerification } from '@opengeni/db';
+import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, SessionCommandActor, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput, ConnectionMetadataWithVerification, SessionCommandReceiptRow } from '@opengeni/db';
 import { DocumentServices } from '@opengeni/documents';
 import { EventBus } from '@opengeni/events';
 import { Observability } from '@opengeni/observability';
@@ -699,11 +699,8 @@ type ResolvedSessionToolPolicy = {
     effectivePolicy: SessionEffectiveToolPolicy;
 };
 type SessionToolPolicyInput = {
-    toolPolicy?: SessionToolPolicy | null;
+    toolPolicy: SessionToolPolicy;
     sessionTools: ToolRef[];
-    turnTools?: ToolRef[];
-    /** Undefined preserves the legacy merge path for pre-provenance callers. */
-    turnToolsProvided?: boolean;
     availableMcpServerIds: Iterable<string>;
     /** Current omitted-tools defaults, intentionally narrower than all servers. */
     defaultMcpServerIds?: Iterable<string>;
@@ -809,7 +806,7 @@ declare class SessionSpawnDeniedError extends Error {
  * as null); child omission snapshots the parent's exact effective selection.
  * Explicit [] is authoritative and must never widen.
  */
-declare function resolveFirstPartyMcpToolsForCreate(requested: FirstPartyMcpToolName[] | undefined, parentStored: FirstPartyMcpToolName[] | null | undefined): FirstPartyMcpToolName[] | null;
+declare function resolveFirstPartyMcpToolsForCreate(requested: FirstPartyMcpToolName[] | undefined, parentStored: FirstPartyMcpToolName[] | null | undefined): FirstPartyMcpToolName[];
 declare function sessionSpawnDenialEnvelope(error: SessionSpawnDeniedError): {
     readonly error: {
         readonly code: "nested_agent_depth_exceeded" | "nested_agent_depth_override_forbidden";
@@ -848,7 +845,7 @@ declare function createAndStartSession(input: {
     resources: ResourceRef[];
     skills?: SessionSkill[];
     tools: ToolRef[];
-    toolPolicy?: SessionToolPolicy;
+    toolPolicy: SessionToolPolicy;
     clientEventId?: string;
     model: string;
     reasoningEffort: Settings["openaiReasoningEffort"];
@@ -869,7 +866,7 @@ declare function createAndStartSession(input: {
     goal?: GoalSpec | null;
     instructions?: string | null;
     firstPartyMcpPermissions?: Permission[] | null;
-    firstPartyMcpTools?: FirstPartyMcpToolName[] | null;
+    firstPartyMcpTools: FirstPartyMcpToolName[];
     mcpServers?: CreateSessionMcpServerInput[];
     sessionMcpServers?: SessionMcpServerMetadata[];
     parentSessionId?: string | null;
@@ -940,8 +937,6 @@ declare function postUserMessageTurn(input: {
     text: string;
     turnInstructions?: string | null;
     resources: ResourceRef[];
-    tools: ToolRef[];
-    toolsProvided: boolean;
     model?: string | null;
     reasoningEffort?: Settings["openaiReasoningEffort"] | null;
     clientEventId?: string;
@@ -974,15 +969,12 @@ declare function createSessionForRequest(deps: ApiRouteDeps, grant: AccessGrant,
  * `POST /sessions/:id/events` and the first-party MCP `session_send_message`
  * tool: resource/tool validation, usage limits, the locked append + turn
  * enqueue, and usage recording. `toolsProvided: false` durably preserves an
- * absent `tools` key so execution inherits the session policy; an explicit
- * empty array is a deliberate per-turn narrowing.
+ * Tool selection is durable session state and never rides a follow-up prompt.
  */
 declare function acceptSessionUserMessage(deps: AcceptSessionUserMessageDependencies, grant: AccessGrant, workspaceId: string, sessionId: string, input: {
     text: string;
     turnInstructions?: string | null;
     resources?: ResourceRef[];
-    tools?: ToolRef[];
-    toolsProvided: boolean;
     model?: string | null;
     reasoningEffort?: ReasoningEffort | null;
     clientEventId?: string;
@@ -1107,6 +1099,8 @@ type HumanSessionCommandContext = {
     workspaceId: string;
     sessionId: string;
     subjectId: string;
+    /** See AgentSessionCommandContext.authorizationSurface. */
+    authorizationSurface?: SessionAuthorizationSurface;
 };
 type AgentSessionCommandContext = {
     accountId: string;
@@ -1116,6 +1110,13 @@ type AgentSessionCommandContext = {
     callerTurnId: string;
     callerAttemptId: string;
     callerExecutionGeneration: number;
+    /**
+     * The trusted adapter surface that owns this command's one authorization
+     * decision. Direct core callers omit it and retain the canonical `core`
+     * surface; adapters that delegate the complete command set it explicitly so
+     * they do not authorize once at the edge and then repeat the host call here.
+     */
+    authorizationSurface?: SessionAuthorizationSurface;
 };
 type SessionAuthorizationCommandDeps = {
     db: Database;
@@ -1151,7 +1152,16 @@ declare function controlAgentSessionWorkstream(deps: {
     action: "pause" | "resume";
     idempotencyKey: string;
     reason?: string | null;
-}): Promise<_opengeni_db.SessionControlMutationResult>;
+}): Promise<{
+    authorization: ResolvedSessionAuthorization | null;
+    receipt: SessionCommandReceiptRow;
+    control: _opengeni_db.EffectiveSessionControl;
+    sessionControlEventId: string;
+    workspaceControlEventId: string;
+    interruptionCount: number;
+    wakeCount: number;
+    replay: boolean;
+}>;
 declare function moveHumanQueuePrompt(deps: {
     db: Database;
     bus: EventBus;

package/dist/index.js

@@ -3251,15 +3251,15 @@ function projectIds(ids) {
   };
 }
 function resolveSessionToolPolicy(input) {
-  const policy = input.toolPolicy ?? { mode: "legacy", inheritedFromSessionId: null };
+  const policy = input.toolPolicy;
   const availableIds = new Set(input.availableMcpServerIds);
   const defaultIds = new Set(input.defaultMcpServerIds ?? []);
   const mandatoryIds = MANDATORY_SESSION_MCP_SERVER_IDS.filter(
     (id) => availableIds.has(id)
   );
   const mandatoryIdSet = new Set(mandatoryIds);
-  const selectedRefs = input.turnToolsProvided === true ? mergeToolRefs2([], input.turnTools ?? []) : input.turnToolsProvided === false ? mergeToolRefs2([], input.sessionTools) : mergeToolRefs2(input.sessionTools, input.turnTools ?? []);
-  const tracksWorkspaceDefaults = policy.mode === "workspace_default" && input.turnToolsProvided !== true;
+  const selectedRefs = mergeToolRefs2([], input.sessionTools);
+  const tracksWorkspaceDefaults = policy.mode === "workspace_default";
   let toolRefs = selectedRefs.filter((tool) => tool.optional !== true || availableIds.has(tool.id));
   if (tracksWorkspaceDefaults) {
     toolRefs = mergeToolRefs2(
@@ -3345,7 +3345,7 @@ function sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDe
   return {
     ...session,
     effectiveToolPolicy: resolveSessionToolPolicy({
-      ...session.toolPolicy ? { toolPolicy: session.toolPolicy } : {},
+      toolPolicy: session.toolPolicy,
       sessionTools: session.tools,
       availableMcpServerIds: availableIds,
       defaultMcpServerIds: workspaceDefaultServerIds
@@ -3378,6 +3378,7 @@ import {
   CreateSessionRequest,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
   DEFAULT_FIRST_PARTY_MCP_TOOLS,
+  FIRST_PARTY_MCP_TOOL_NAMES,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY as OPENGENI_SLACK_BOT_SESSION_METADATA_KEY2,
   SessionSpawnDenial,
   ServiceTurnInitiator,
@@ -3502,7 +3503,7 @@ var SessionSpawnDeniedError = class extends Error {
 };
 function resolveFirstPartyMcpToolsForCreate(requested, parentStored) {
   if (requested !== void 0) return [...requested];
-  if (parentStored === void 0) return null;
+  if (parentStored === void 0) return [...DEFAULT_FIRST_PARTY_MCP_TOOLS];
   return [...parentStored ?? DEFAULT_FIRST_PARTY_MCP_TOOLS];
 }
 function sessionSpawnDeniedMessage(denial) {
@@ -3798,7 +3799,7 @@ async function createAndStartSession(input) {
       resources: input.resources,
       skills: input.skills ?? [],
       tools: input.tools,
-      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
+      toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
       ...input.createdBy ? { createdBy: input.createdBy } : {},
       ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
@@ -3809,7 +3810,7 @@ async function createAndStartSession(input) {
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
-      firstPartyMcpTools: input.firstPartyMcpTools ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey: input.createIdempotencyKey,
@@ -3843,7 +3844,7 @@ async function createAndStartSession(input) {
       resources: input.resources,
       skills: input.skills ?? [],
       tools: input.tools,
-      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
+      toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
       ...input.createdBy ? { createdBy: input.createdBy } : {},
       ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
@@ -3854,7 +3855,7 @@ async function createAndStartSession(input) {
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
-      firstPartyMcpTools: input.firstPartyMcpTools ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       sandboxGroupId: input.sandboxGroupId ?? null,
@@ -3908,7 +3909,7 @@ async function finishStartSession(input, session) {
     reasoningEffortFallback: input.reasoningEffort,
     turnExecutionPolicy: input.turnExecutionPolicy,
     createdEventPayload: {
-      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
+      toolPolicy: input.toolPolicy,
       ...input.variableSet ? { variableSetId: input.variableSet.id, variableSetName: input.variableSet.name } : {},
       ...input.sessionMcpServers?.length ? { mcpServers: input.sessionMcpServers } : {}
     },
@@ -4021,8 +4022,6 @@ async function postUserMessageTurn(input) {
           text: input.text,
           turnInstructions: input.turnInstructions ?? null,
           resources: input.resources,
-          tools: input.tools,
-          toolsProvided: input.toolsProvided,
           model: requestedModel,
           reasoningEffort: requestedReasoningEffort,
           reasoningEffortFallback: input.reasoningEffortFallback ?? settings.openaiReasoningEffort,
@@ -4255,9 +4254,8 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
     parentSession ? parentSession.firstPartyMcpTools : void 0
   );
   if (payload.goal) {
-    const effectiveTools = firstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS];
     const missingGoalTools = ["goal_update", "goal_complete", "goal_pause"].filter(
-      (name) => !effectiveTools.includes(name)
+      (name) => !firstPartyMcpTools.includes(name)
     );
     if (missingGoalTools.length > 0) {
       throw new HTTPException10(422, {
@@ -4458,22 +4456,12 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   return session;
 }
 async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, input) {
-  if (input.toolsProvided && !deps.settings.sessionTurnToolReplacementEnabled) {
-    throw new HTTPException10(503, {
-      message: "explicit follow-up tool replacement is temporarily unavailable until provenance-aware turn workers finish rolling out; omit tools to inherit the session policy and retry"
-    });
-  }
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   await requireSessionAuthorization(deps, grant, {
     sessionId,
     operation: input.delivery === "steer" ? "session.steer" : "session.append",
     surface: "core"
   });
-  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
-    db,
-    workspaceId,
-    settings
-  );
   const existingSession = await requireSession2(db, workspaceId, sessionId);
   const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
   const effectiveModel = canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;
@@ -4492,27 +4480,7 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     reasoningEffort: effectiveReasoningEffort,
     reasoningSource: input.reasoningEffort == null ? "session" : "explicit"
   });
-  const runtimeSettings = settingsWithSessionMcpServerMetadata(
-    capabilityRuntimeSettings,
-    existingSession.mcpServers
-  );
   const requestedResources = normalizeResources(input.resources ?? []);
-  const tracksWorkspaceDefaults = existingSession.toolPolicy?.mode === "workspace_default";
-  const sessionPolicyTools = withFirstPartyTools(
-    tracksWorkspaceDefaults ? withDefaultEnabledCapabilityMcpTools(
-      availableToolRefs(existingSession.tools, runtimeSettings),
-      settings,
-      capabilityRuntimeSettings
-    ) : existingSession.tools,
-    runtimeSettings
-  );
-  const validatedTools = input.toolsProvided ? validateToolRefsForSessionPolicy({
-    requested: input.tools ?? [],
-    settings: runtimeSettings,
-    allowedTools: sessionPolicyTools,
-    message: "message tools may only narrow the session tool policy"
-  }) : [];
-  const requestedTools = input.toolsProvided ? validatedTools : [];
   await requireLimit(deps, {
     accountId: grant.accountId,
     workspaceId,
@@ -4546,8 +4514,6 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     text: input.text,
     turnInstructions: input.turnInstructions ?? null,
     resources: requestedResources,
-    tools: requestedTools,
-    toolsProvided: input.toolsProvided,
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
     reasoningEffortFallback: sessionReasoningEffort,
@@ -4654,7 +4620,7 @@ async function updateSessionMcpApprovalPolicy(deps, grant, sessionId, serverId,
     effectiveFrom: "next_attempt"
   };
 }
-function toolPolicyAuditSnapshot(session, tools, policy = session.toolPolicy ?? { mode: "legacy", inheritedFromSessionId: null }) {
+function toolPolicyAuditSnapshot(session, tools, firstPartyMcpTools, policy = session.toolPolicy) {
   const allToolRefs = mergeToolRefs([], tools).sort((left, right) => {
     const leftMandatory = left.kind === "mcp" && left.id === "opengeni";
     const rightMandatory = right.kind === "mcp" && right.id === "opengeni";
@@ -4673,6 +4639,8 @@ function toolPolicyAuditSnapshot(session, tools, policy = session.toolPolicy ??
     toolIds: [...toolRefs].sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`)).map((tool) => tool.id),
     toolRefs,
     toolCount: allToolRefs.length,
+    firstPartyMcpTools: [...firstPartyMcpTools].sort(),
+    firstPartyMcpToolCount: firstPartyMcpTools.length,
     truncated: allToolRefs.length > toolRefs.length
   };
 }
@@ -4706,10 +4674,12 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
     }
     return withFirstPartyTools(validatedTools, runtimeSettings);
   })() : null;
+  const explicitRequestedFirstPartyTools = explicitRequest ? [...explicitRequest.firstPartyMcpTools] : null;
   const workspaceDefaultTools = withFirstPartyTools(
     withDefaultEnabledCapabilityMcpTools([], deps.settings, capabilityRuntimeSettings),
     runtimeSettings
   );
+  const workspaceDefaultFirstPartyTools = [...FIRST_PARTY_MCP_TOOL_NAMES];
   const events = await appendSessionEventsWithLockedSessionUpdate(
     deps.db,
     grant.workspaceId,
@@ -4720,6 +4690,7 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
         throw new SessionToolPolicyVersionConflictError(currentVersion);
       }
       let nextTools;
+      let nextFirstPartyMcpTools;
       let nextPolicy;
       if (session.parentSessionId) {
         const parent = await context.getLockedSession(session.parentSessionId);
@@ -4735,6 +4706,9 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
           ) : parent.tools,
           runtimeSettings
         );
+        const parentFirstPartyMcpTools = [
+          ...parent.firstPartyMcpTools ?? DEFAULT_FIRST_PARTY_MCP_TOOLS
+        ];
         if (requestedMode === "workspace_default") {
           if (!parentTracksWorkspaceDefaults) {
             throw new HTTPException10(403, {
@@ -4742,6 +4716,7 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
             });
           }
           nextTools = parentEffective;
+          nextFirstPartyMcpTools = parentFirstPartyMcpTools;
           nextPolicy = {
             mode: "workspace_default",
             inheritedFromSessionId: parent.id
@@ -4753,6 +4728,16 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
             parentEffective,
             "session tools may only narrow the parent session tool policy"
           );
+          const parentFirstPartySet = new Set(parentFirstPartyMcpTools);
+          const widenedFirstPartyTool = explicitRequestedFirstPartyTools.find(
+            (tool) => !parentFirstPartySet.has(tool)
+          );
+          if (widenedFirstPartyTool) {
+            throw new HTTPException10(403, {
+              message: `session OpenGeni tools may only narrow the parent policy: ${widenedFirstPartyTool}`
+            });
+          }
+          nextFirstPartyMcpTools = explicitRequestedFirstPartyTools;
           nextPolicy = {
             mode: "explicit",
             inheritedFromSessionId: parent.id
@@ -4760,13 +4745,19 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
         }
       } else {
         nextTools = requestedMode === "workspace_default" ? workspaceDefaultTools : explicitRequestedTools;
+        nextFirstPartyMcpTools = requestedMode === "workspace_default" ? workspaceDefaultFirstPartyTools : explicitRequestedFirstPartyTools;
         nextPolicy = { mode: requestedMode, inheritedFromSessionId: null };
       }
-      const currentPolicy = session.toolPolicy ?? {
-        mode: "legacy",
-        inheritedFromSessionId: null
-      };
-      const unchanged = stableJson2({ tools: session.tools, policy: currentPolicy }) === stableJson2({ tools: nextTools, policy: nextPolicy });
+      const currentPolicy = session.toolPolicy;
+      const unchanged = stableJson2({
+        tools: session.tools,
+        firstPartyMcpTools: session.firstPartyMcpTools ?? DEFAULT_FIRST_PARTY_MCP_TOOLS,
+        policy: currentPolicy
+      }) === stableJson2({
+        tools: nextTools,
+        firstPartyMcpTools: nextFirstPartyMcpTools,
+        policy: nextPolicy
+      });
       if (unchanged) {
         return { events: [] };
       }
@@ -4776,8 +4767,18 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
           {
             type: "session.tool_policy.updated",
             payload: {
-              before: toolPolicyAuditSnapshot(session, session.tools, currentPolicy),
-              after: toolPolicyAuditSnapshot(session, nextTools, nextPolicy),
+              before: toolPolicyAuditSnapshot(
+                session,
+                session.tools,
+                [...session.firstPartyMcpTools ?? DEFAULT_FIRST_PARTY_MCP_TOOLS],
+                currentPolicy
+              ),
+              after: toolPolicyAuditSnapshot(
+                session,
+                nextTools,
+                nextFirstPartyMcpTools,
+                nextPolicy
+              ),
               version: nextVersion,
               effectiveFrom: "next_attempt"
             }
@@ -4785,6 +4786,7 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
         ],
         update: {
           tools: nextTools,
+          firstPartyMcpTools: nextFirstPartyMcpTools,
           toolPolicy: nextPolicy,
           toolPolicyVersion: nextVersion,
           expectedToolPolicyVersion: request.expectedVersion
@@ -5355,14 +5357,14 @@ async function authorizeHumanSessionCommand(deps, context, operation) {
   return await requireSessionAuthorization(deps, humanAccessGrant(context), {
     sessionId: context.sessionId,
     operation,
-    surface: "core"
+    surface: context.authorizationSurface ?? "core"
   });
 }
 async function authorizeAgentSessionCommand(deps, context, targetSessionId, operation) {
   return await requireSessionAuthorization(deps, agentAccessGrant(context), {
     sessionId: targetSessionId,
     operation,
-    surface: "core"
+    surface: context.authorizationSurface ?? "core"
   });
 }
 function agentActor(context) {
@@ -5493,7 +5495,12 @@ async function steerAgentSession(deps, context, input) {
   return result;
 }
 async function controlAgentSessionWorkstream(deps, context, input) {
-  await authorizeAgentSessionCommand(deps, context, input.targetSessionId, "session.control");
+  const authorization = await authorizeAgentSessionCommand(
+    deps,
+    context,
+    input.targetSessionId,
+    "session.control"
+  );
   const result = await withWorkspaceRls(
     deps.db,
     context.workspaceId,
@@ -5514,7 +5521,7 @@ async function controlAgentSessionWorkstream(deps, context, input) {
   ]);
   await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);
   await requestControlWakeDispatch(deps, result.wakeCount);
-  return result;
+  return { ...result, authorization };
 }
 function receipt(row) {
   return {
@@ -5536,8 +5543,6 @@ function composerDraft(row) {
     revision: row.revision,
     text: row.text,
     resources: row.resources,
-    tools: row.tools,
-    toolsProvided: row.toolsProvided,
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     sourceTurnId: row.sourceTurnId,
@@ -5755,8 +5760,6 @@ async function getHumanComposerDraft(deps, context) {
     revision: 0,
     text: "",
     resources: [],
-    tools: [],
-    toolsProvided: false,
     model: session.model,
     reasoningEffort: reasoningEffortForMetadata2(session.metadata, "medium"),
     sourceTurnId: null,