@opengeni/core 0.28.0 → 1.0.0

package/dist/domain/scheduled-tasks.d.ts

@@ -1,8 +1,10 @@
-import type { Settings } from "@opengeni/config";
-import type { AccessGrant, McpPersonalConnectionDelegation, ScheduledTask, ScheduledTaskAgentConfig, Session, SessionAuthorizationPort, SessionAuthorizationSurface, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
-import { type Database, type UpdateScheduledTaskInput } from "@opengeni/db";
+import { type Settings } from "@opengeni/config";
+import type { AccessGrant, ScheduledTask, ScheduledTaskAgentConfig, Session, ToolRef, SessionAuthorizationPort, SessionAuthorizationSurface, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
+import { type KnowledgeContext, type Database, type ScheduledTaskCreatorPolicy, type SessionCommandActor, type TemporalScheduleCleanupClaim, type UpdateScheduledTaskInput } from "@opengeni/db";
+import { type AccessGrantAuthorization } from "../access/index.js";
 import type { SessionWorkflowClient } from "../dependencies.js";
 import type { ObjectStorageDependency } from "../dependencies.js";
+import { type ScheduledTaskSlackChannelVerifier } from "./slack-bot.js";
 /**
  * Whether a raw scheduled-task payload explicitly set agentConfig.tools.
  * Zod's `.default([])` erases the distinction between "absent" and
@@ -12,17 +14,61 @@ import type { ObjectStorageDependency } from "../dependencies.js";
  * verbatim.
  */
 export declare function scheduledTaskToolsProvided(rawPayload: unknown): boolean;
+/** Resolve the target's current tool policy before choosing its owner's accounts. */
+export declare function scheduledConnectionTools(db: Database, workspaceId: string, settings: Settings, target: Session | null, taskTools: ToolRef[], subjectId?: string): Promise<ToolRef[]>;
+export declare function scheduledConnectionSurfaceEligibility(settings: Settings, target: Pick<Session, "firstPartyMcpTools" | "firstPartyMcpPermissions"> | null): {
+    googleDrivePublicationEnabled: boolean;
+    atlassianEnabled: boolean;
+};
 export declare function createValidatedScheduledTask(input: {
     settings: Settings;
     db: Database;
     objectStorage: ObjectStorageDependency;
     grant: AccessGrant;
+    authorization?: AccessGrantAuthorization;
     payload: CreateScheduledTaskPayload;
     toolsProvided?: boolean;
-    variableSetPreauthorized?: boolean;
     sessionAuthorization?: SessionAuthorizationPort | null | undefined;
     authorizationSurface?: SessionAuthorizationSurface | undefined;
+    /** Proves the bot may post in a newly chosen task Slack channel. */
+    verifySlackChannel?: ScheduledTaskSlackChannelVerifier | undefined;
+}): Promise<ScheduledTask>;
+/**
+ * Freeze authenticated credential restrictions for every creation lane, and
+ * the creating session's boundary onto an agent-created task so the
+ * sessions generated for it inherit exactly what the creator could see and
+ * do, never the deployment default. Tools are the session's effective
+ * model-visible selection under the deployment ceiling; permissions are the
+ * session's effective first-party set intersected with what the calling
+ * grant actually holds (a narrowly delegated spawn token cannot hand a
+ * schedule more than itself). The session access policy is copied from the
+ * projection when it exposes those facts; each absent fact is stored as null
+ * so a generated session keeps its own default for that key.
+ */
+export declare function frozenScheduledTaskCreatorPolicy(input: {
+    db: Database;
+    settings: Settings;
+    grant: AccessGrant;
+    authorization?: AccessGrantAuthorization | undefined;
+    actor: Extract<SessionCommandActor, {
+        type: "agent_attempt";
+    }> | null;
+}): Promise<ScheduledTaskCreatorPolicy | null>;
+/**
+ * Scheduled-task authority writes fail closed inside SECURITY DEFINER seams
+ * (42501): a non-human writer delegating resources, an authorizer without
+ * active workspace membership, or a foreign human retaining another subject's
+ * grants. Those are caller-resolvable conflicts, not server faults.
+ */
+export declare function withScheduledTaskAuthorityWriteErrors<T>(run: () => Promise<T>): Promise<T>;
+/** API/MCP-facing update that maps authority-write denials to 409. */
+export declare function updateScheduledTaskForApi(db: Database, grant: AccessGrant, taskId: string, update: UpdateScheduledTaskInput, learning?: {
+    authorization: AccessGrantAuthorization;
+    request: NonNullable<UpdateScheduledTaskPayload["agentLearning"]>;
+    restoreState: ScheduledTaskRestoreState;
 }): Promise<ScheduledTask>;
+export declare function assertScheduledTaskMutationOwner(db: Database, grant: AccessGrant, taskId: string): Promise<void>;
+export declare function triggerScheduledTaskForGrant(db: Database, grant: AccessGrant, workflowClient: SessionWorkflowClient, input: Parameters<SessionWorkflowClient["triggerScheduledTask"]>[0]): Promise<void>;
 export declare function validateScheduledTaskTarget(input: {
     db: Database;
     sessionAuthorization?: SessionAuthorizationPort | null | undefined;
@@ -34,34 +80,78 @@ export declare function validateScheduledTaskTarget(input: {
     rigId: string | null | undefined;
     agentConfig: ScheduledTaskAgentConfig;
     missingTargetStatus?: 404 | 422;
+    /** Leaving a cancelled chat still requires control, but not revivability. */
+    departingTarget?: boolean;
 }): Promise<Session | null>;
+export declare function validateScheduledTaskMachineTarget(input: {
+    settings: Settings;
+    db: Database;
+    grant: AccessGrant;
+    runMode: ScheduledTask["runMode"];
+    agentConfig: ScheduledTaskAgentConfig;
+    requireOnline?: boolean;
+}): Promise<{
+    sandboxId: string;
+    enrollmentId: string;
+    sandboxOs: Session["sandboxOs"];
+} | null>;
 export declare function scheduledTaskForGrant(task: ScheduledTask, grant: AccessGrant): ScheduledTask;
 export declare function scheduledTaskRunForGrant<T extends {
     sessionId: string | null;
 }>(run: T, grant: AccessGrant): T;
+export declare function scheduledTaskAuthorityUpdateForGrant(grant: AccessGrant): Pick<UpdateScheduledTaskInput, "refreshPersonalResourceAuthority" | "authorityUpdatedBy" | "authorityUpdatedByContext" | "authorityUpdatedByActor">;
 export declare function validatedScheduledTaskUpdate(input: {
     settings: Settings;
     db: Database;
     objectStorage: ObjectStorageDependency;
     grant: AccessGrant;
+    authorization?: AccessGrantAuthorization;
     existing: ScheduledTask;
     payload: UpdateScheduledTaskPayload;
     /** See createValidatedScheduledTask; only consulted when agentConfig is updated. */
     toolsProvided?: boolean;
     sessionAuthorization?: SessionAuthorizationPort | null | undefined;
     authorizationSurface?: SessionAuthorizationSurface | undefined;
+    /** Proves the bot may post in a newly chosen task Slack channel. */
+    verifySlackChannel?: ScheduledTaskSlackChannelVerifier | undefined;
 }): Promise<UpdateScheduledTaskInput>;
 export declare function requireScheduledTaskForApi(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
 export type ScheduledTaskRestoreState = {
     task: ScheduledTask;
-    personalConnectionDelegations: McpPersonalConnectionDelegation[];
+    learning?: {
+        context: KnowledgeContext;
+        scope: "workspace" | "personal";
+        settings: import("@opengeni/contracts").AgentLearningOverridePatch;
+        expectedVersion: number;
+    };
 };
-export declare function captureScheduledTaskRestoreState(db: Database, task: ScheduledTask): Promise<ScheduledTaskRestoreState>;
+export declare function captureScheduledTaskRestoreState(_db: Database, task: ScheduledTask): Promise<ScheduledTaskRestoreState>;
 export declare function restoreScheduledTask(db: Database, previous: ScheduledTaskRestoreState): Promise<ScheduledTask>;
 export declare class ScheduledTaskSyncError extends Error {
     readonly persistenceRestored: boolean;
     constructor(cause: unknown, persistenceRestored: boolean);
 }
+/**
+ * One deletion lifecycle shared by HTTP and first-party MCP adapters.
+ * Connector authorization is proven before the one-way tombstone. The same
+ * transaction detaches reclaimable task resources and persists both external
+ * cleanup obligations; best-effort processing is only an acceleration of that
+ * durable receipt.
+ */
+export declare function deleteScheduledTaskLifecycle(input: {
+    db: Database;
+    workspaceId: string;
+    taskId: string;
+    subjectId: string;
+    beforeDeleteCommit?: (tx: Database) => Promise<void>;
+    preflightConnectorAuthorization: (task: ScheduledTask) => Promise<void>;
+    cleanupConnectorAuthorization: (db: Database, task: ScheduledTask) => Promise<void>;
+    processCleanupClaims?: (claims: readonly TemporalScheduleCleanupClaim[]) => Promise<void>;
+}): Promise<{
+    task: ScheduledTask;
+    changed: boolean;
+    cleanup: TemporalScheduleCleanupClaim | null;
+}>;
 export declare function syncCreatedScheduledTask(input: {
     db: Database;
     workflowClient: SessionWorkflowClient;
@@ -99,3 +189,10 @@ export declare function manualScheduledTaskTriggerWorkflowId(taskId: string, tri
  * and the run dedupe together under retry.
  */
 export declare function manualScheduledTaskTriggerUsageKey(workspaceId: string, taskId: string, triggerToken: string): string;
+/**
+ * Static incident-telemetry admission validates only already-selected task
+ * authority. It never discovers a resource, reads a variable value, probes a
+ * provider, or treats ambient worker credentials as responder capability.
+ * Mutable rig/variable-set metadata is revalidated again at dispatch.
+ */
+export declare function validateIncidentTelemetryPreflightSelection(settings: Pick<Settings, "allowedFirstPartyMcpTools" | "defaultFirstPartyMcpTools">, agentConfig: ScheduledTaskAgentConfig): void;

package/dist/domain/session-connection-accounts.d.ts

@@ -0,0 +1,16 @@
+import type { AccessGrant } from "@opengeni/contracts";
+import type { Settings } from "@opengeni/config";
+import { type Database } from "@opengeni/db";
+/** Freeze the authenticated request's eligible accounts before starting voice.
+ * The resulting lease snapshot, not a later participant or ambient connection,
+ * supplies authority to both live delegations and automatic transcript handoff. */
+export declare function freezeSessionRealtimeConnectionAccounts(input: {
+    db: Database;
+    settings: Settings;
+    grant: AccessGrant;
+    workspaceId: string;
+    sessionId: string;
+}): Promise<{
+    mcpAccountBindings: import("@opengeni/contracts").McpConnectionAccountBinding[] | null;
+    personalConnectionDelegations: import("@opengeni/contracts").McpPersonalConnectionDelegation[];
+}>;

package/dist/domain/session-file-access.d.ts

@@ -0,0 +1,4 @@
+import type { AccessGrant, FileAsset } from "@opengeni/contracts";
+import type { SessionAuthorizationDependencies } from "../session-authorization.js";
+/** A session attachment grant is never a generic file/Knowledge grant. */
+export declare function readSessionAttachmentFiles(deps: SessionAuthorizationDependencies, grant: AccessGrant, sessionId: string, fileIds: readonly string[]): Promise<FileAsset[]>;

package/dist/domain/session-native-connection-replacement.d.ts

@@ -0,0 +1,14 @@
+import type { ConnectionMetadata, McpServerConnectionRef } from "@opengeni/contracts";
+/** Selection is restricted to the caller's already-authorized inventory. This
+ * projection grants no execution authority: subsequent admission and physical
+ * credential use still validate the exact native account normally. */
+export declare function nativeSessionConnectionReplacement(input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    serverUrl: string;
+    replacementServerUrl?: string;
+    currentRef: McpServerConnectionRef | null;
+    nativeConnectionId: string;
+    connections: ConnectionMetadata[];
+}): McpServerConnectionRef;

package/dist/domain/session-start-timing.d.ts

@@ -0,0 +1,7 @@
+import { type Observability } from "@opengeni/observability";
+type SessionStartPhase = "workspace_read" | "model_catalog_initial" | "default_model" | "model_catalog_effective" | "capability_settings" | "initiator_freeze" | "allowance" | "shell_insert" | "initialize" | "event_fanout" | "workflow_wake" | "session_reload";
+export type SessionStartObservability = Pick<Observability, "startSpan">;
+/** Content-free child spans around existing work; export is never joined and
+ * diagnostic failures cannot alter the lifecycle or its exact error. */
+export declare function measureSessionStartPhase<T>(observability: SessionStartObservability | null | undefined, phase: SessionStartPhase, work: () => Promise<T>): Promise<T>;
+export {};

package/dist/domain/session-tool-policy.d.ts

@@ -1,6 +1,6 @@
-import type { Settings } from "@opengeni/config";
-import { type Session, type SessionEffectiveToolPolicy, type SessionToolPolicy, type ToolRef } from "@opengeni/contracts";
-import type { Database } from "@opengeni/db";
+import { type Settings } from "@opengeni/config";
+import { type AgentToolEnvironment, type AgentMediaAttachment, type Session, type SessionTurn, type SessionEffectiveToolPolicy, type SessionToolPolicy, type ToolRef } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
 export type ResolvedSessionToolPolicy = {
     toolRefs: ToolRef[];
     effectivePolicy: SessionEffectiveToolPolicy;
@@ -23,9 +23,98 @@ export declare function defaultSessionMcpServerIds(servers: Iterable<{
  * `defaultMcpServerIds` is the current configured omitted-tools default.
  */
 export declare function resolveSessionToolPolicy(input: SessionToolPolicyInput): ResolvedSessionToolPolicy;
+/** Null is ordinary work; an empty list is a frozen scheduled selection. */
+export declare function scheduledTurnMcpServerIds(turn: Pick<SessionTurn, "metadata">): string[] | null;
+/**
+ * Execution's canonical turn selection. Ordinary turns use the durable session
+ * policy, not the queue's omitted-tools `[]`. Scheduled turns instead retain
+ * their frozen registry and refs, including an explicitly empty selection.
+ */
+export declare function resolveTurnToolPolicy(input: Omit<SessionToolPolicyInput, "sessionTools"> & {
+    session: Pick<Session, "tools">;
+    turn: Pick<SessionTurn, "tools" | "metadata">;
+}): ResolvedSessionToolPolicy;
+/** Resolve availability and defaults from the same subject-scoped registry read. */
+export declare function workspaceSessionToolPolicyContext(db: Database, workspaceId: string, settings: Settings, subjectId?: string): Promise<{
+    workspaceServerIds: string[];
+    workspaceDefaultServerIds: string[];
+}>;
 /** Current full runtime registry IDs, including configured static servers. */
 export declare function workspaceSessionToolPolicyServerIds(db: Database, workspaceId: string, settings: Settings, subjectId?: string): Promise<string[]>;
 /** Current omitted-tools defaults: every configured runtime MCP is on. */
 export declare function workspaceSessionToolPolicyDefaultServerIds(db: Database, workspaceId: string, settings: Settings, subjectId?: string): Promise<string[]>;
+/**
+ * The omitted-tools default for one resolved runtime registry and one
+ * workspace settings bag. Pure so a caller that already holds both never has
+ * to re-query the capability registry to agree with the worker and the
+ * composer on which connectors a `workspace_default` session executes with.
+ */
+export declare function workspaceSessionToolPolicyDefaultServerIdsFor(runtimeMcpServers: Iterable<{
+    id: string;
+}>, workspaceSettings: unknown): string[];
+/** Metadata only: no MCP listing, provider probes, account selection or credentials. */
+export type SessionEffectiveToolsContext = {
+    settings: Settings;
+    humanInputEnabled: boolean;
+    hasWorkspaceSkills: boolean;
+    workspaceSettings?: unknown;
+    objectStorageAvailable: boolean;
+    activeSandboxBackends?: ReadonlyMap<string, Settings["sandboxBackend"]>;
+    /** Exact build options after adapter/credential resolution, keyed by session. No pool-readiness inference. */
+    mediaAttachments?: ReadonlyMap<string, AgentMediaAttachment>;
+    routerInHistory?: boolean;
+    routerHistorySessionIds?: ReadonlySet<string>;
+};
+/**
+ * Resolve one context for a response page, not one catalog per session. Legacy
+ * rows require no additional reads and never acquire an effectiveTools field.
+ */
+export declare function workspaceSessionEffectiveToolsContext(deps: {
+    db: Database;
+    settings: Settings;
+    objectStorage?: unknown;
+}, workspaceId: string, subjectId: string, sessions: readonly Session[]): Promise<SessionEffectiveToolsContext>;
+/** The server can prove attachment policy, not successful future provider calls. */
+export declare function sessionEffectiveToolProjectionInput(session: Session & {
+    agent: NonNullable<Session["agent"]>;
+}, toolRefs: readonly ToolRef[], context?: SessionEffectiveToolsContext): {
+    config: {
+        version: 1;
+        from: "all" | "none";
+        capabilities: {
+            webSearch: boolean;
+            humanInput: boolean;
+            skills: "manage" | "read" | false;
+            goals: boolean;
+            subagents: boolean;
+            knowledge: boolean;
+            schedules: boolean;
+            artifacts: boolean;
+            browser: boolean;
+            media: boolean;
+            workspaceFiles: boolean;
+            workspaceConnectors: boolean;
+            workspaceAdmin: boolean;
+        };
+        unavailable: ("artifacts" | "browser" | "goals" | "humanInput" | "knowledge" | "media" | "schedules" | "skills" | "subagents" | "webSearch" | "workspaceAdmin" | "workspaceConnectors" | "workspaceFiles")[];
+        identity: string | null;
+        renderer: "markdown" | "opengeni";
+        source: "deployment_default" | "inherited" | "legacy_conversion" | "request" | "workspace_default";
+    };
+    firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+    firstPartyModelNames: Map<"artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch", string>;
+    mcpServerIds: string[];
+    productServerIds: ReadonlySet<string>;
+    environment: AgentToolEnvironment;
+    runtimeToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_search" | "write_stdin" | "x_search")[];
+    hostedToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_search" | "write_stdin" | "x_search")[];
+    sandboxToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_search" | "write_stdin" | "x_search")[];
+    routerToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_search" | "write_stdin" | "x_search")[];
+    upfrontToolNames: Set<string>;
+    mediaAttachment: AgentMediaAttachment | {
+        readonly image: null;
+        readonly video: false;
+    } | undefined;
+};
 /** Add a bounded, secret-safe effective projection to a session response. */
-export declare function sessionWithEffectiveToolPolicy(session: Session, workspaceServerIds: Iterable<string>, workspaceDefaultServerIds?: Iterable<string>): Session;
+export declare function sessionWithEffectiveToolPolicy(session: Session, workspaceServerIds: Iterable<string>, workspaceDefaultServerIds?: Iterable<string>, effectiveToolsContext?: SessionEffectiveToolsContext): Session;