@opengeni/core 0.8.0 → 0.10.0

package/dist/index.js

@@ -2698,6 +2698,22 @@ function enabledCapabilityMcpToolRefs(settings, runtimeSettings) {
 function withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings) {
   return mergeToolRefs(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));
 }
+function availableToolRefs(tools, settings) {
+  const available = new Set(settings.mcpServers.map((server) => server.id));
+  return tools.filter((tool) => available.has(tool.id));
+}
+function assertToolRefsSubset(requested, allowed, message = "requested tools exceed the session tool policy") {
+  const allowedIds = new Set(allowed.map((tool) => `${tool.kind}:${tool.id}`));
+  const widened = requested.find((tool) => !allowedIds.has(`${tool.kind}:${tool.id}`));
+  if (widened) {
+    throw new HTTPException8(403, { message: `${message}: ${widened.id}` });
+  }
+}
+function validateToolRefsForSessionPolicy(input) {
+  const validated = validateToolRefs(input.requested, input.settings);
+  assertToolRefsSubset(validated, input.allowedTools, input.message);
+  return validated;
+}
 function normalizeResources(resources) {
   const mountPaths = /* @__PURE__ */ new Map();
   const identities = /* @__PURE__ */ new Map();
@@ -2902,6 +2918,128 @@ function positiveInteger(value) {
   return null;
 }
 
+// src/domain/session-tool-policy.ts
+import {
+  SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
+  SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH,
+  mergeToolRefs as mergeToolRefs2
+} from "@opengeni/contracts";
+var MANDATORY_SESSION_MCP_SERVER_IDS = ["opengeni"];
+var PROJECTABLE_REGISTRY_ID = /^[A-Za-z0-9_-]+$/;
+function sortedIds(ids) {
+  return [...new Set(ids)].sort();
+}
+function projectIds(ids) {
+  const projectable = ids.filter(
+    (id) => id.length <= SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH && PROJECTABLE_REGISTRY_ID.test(id)
+  );
+  return {
+    ids: projectable.slice(0, SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT),
+    truncated: projectable.length !== ids.length || projectable.length > SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT
+  };
+}
+function resolveSessionToolPolicy(input) {
+  const policy = input.toolPolicy ?? { mode: "legacy", inheritedFromSessionId: null };
+  const availableIds = new Set(input.availableMcpServerIds);
+  const defaultIds = new Set(input.defaultMcpServerIds ?? []);
+  const mandatoryIds = MANDATORY_SESSION_MCP_SERVER_IDS.filter(
+    (id) => availableIds.has(id)
+  );
+  const mandatoryIdSet = new Set(mandatoryIds);
+  const selectedRefs = input.turnToolsProvided === true ? mergeToolRefs2([], input.turnTools ?? []) : input.turnToolsProvided === false ? mergeToolRefs2([], input.sessionTools) : mergeToolRefs2(input.sessionTools, input.turnTools ?? []);
+  const tracksWorkspaceDefaults = policy.mode === "workspace_default" && input.turnToolsProvided !== true;
+  let toolRefs = selectedRefs.filter((tool) => tool.optional !== true || availableIds.has(tool.id));
+  if (tracksWorkspaceDefaults) {
+    toolRefs = mergeToolRefs2(
+      toolRefs,
+      sortedIds(defaultIds).filter((id) => availableIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true }))
+    );
+  }
+  toolRefs = mergeToolRefs2(
+    toolRefs,
+    mandatoryIds.map((id) => ({ kind: "mcp", id }))
+  );
+  const requestedEffectiveRefs = mergeToolRefs2(
+    selectedRefs,
+    tracksWorkspaceDefaults ? sortedIds(defaultIds).filter((id) => availableIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true })) : []
+  );
+  const effectiveIds = sortedIds(
+    mergeToolRefs2(
+      requestedEffectiveRefs,
+      mandatoryIds.map((id) => ({ kind: "mcp", id }))
+    ).map((tool) => tool.id)
+  );
+  const configuredIds = effectiveIds.filter((id) => availableIds.has(id));
+  const configuredIdSet = new Set(configuredIds);
+  const droppedIds = effectiveIds.filter((id) => !configuredIdSet.has(id));
+  const deferredIds = tracksWorkspaceDefaults ? sortedIds(
+    toolRefs.filter(
+      (tool) => tool.optional === true && configuredIdSet.has(tool.id) && !mandatoryIdSet.has(tool.id)
+    ).map((tool) => tool.id)
+  ) : [];
+  const selectedIds = sortedIds(
+    selectedRefs.filter(
+      (tool) => !mandatoryIdSet.has(tool.id) && !(tracksWorkspaceDefaults && tool.optional === true)
+    ).map((tool) => tool.id)
+  );
+  const projections = {
+    selected: projectIds(selectedIds),
+    effective: projectIds(effectiveIds),
+    mandatory: projectIds(sortedIds(mandatoryIds)),
+    deferred: projectIds(deferredIds),
+    configured: projectIds(configuredIds),
+    dropped: projectIds(droppedIds)
+  };
+  return {
+    toolRefs,
+    effectivePolicy: {
+      mode: policy.mode,
+      inheritedFromSessionId: policy.inheritedFromSessionId,
+      selectedIds: projections.selected.ids,
+      effectiveIds: projections.effective.ids,
+      mandatoryIds: projections.mandatory.ids,
+      lazyRouter: {
+        state: tracksWorkspaceDefaults ? "required" : "disabled",
+        deferredIds: projections.deferred.ids
+      },
+      configuredIds: projections.configured.ids,
+      droppedIds: projections.dropped.ids,
+      counts: {
+        selected: selectedIds.length,
+        effective: effectiveIds.length,
+        mandatory: mandatoryIds.length,
+        deferred: deferredIds.length,
+        configured: configuredIds.length,
+        dropped: droppedIds.length
+      },
+      idsTruncated: Object.values(projections).some((projection) => projection.truncated)
+    }
+  };
+}
+async function workspaceSessionToolPolicyServerIds(db, workspaceId, settings) {
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
+  return sortedIds(runtimeSettings.mcpServers.map((server) => server.id));
+}
+async function workspaceSessionToolPolicyDefaultServerIds(db, workspaceId, settings) {
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
+  return sortedIds(enabledCapabilityMcpToolRefs(settings, runtimeSettings).map((tool) => tool.id));
+}
+function sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDefaultServerIds = []) {
+  const availableIds = new Set(workspaceServerIds);
+  for (const server of session.mcpServers) {
+    availableIds.add(server.id);
+  }
+  return {
+    ...session,
+    effectiveToolPolicy: resolveSessionToolPolicy({
+      ...session.toolPolicy ? { toolPolicy: session.toolPolicy } : {},
+      sessionTools: session.tools,
+      availableMcpServerIds: availableIds,
+      defaultMcpServerIds: workspaceDefaultServerIds
+    }).effectivePolicy
+  };
+}
+
 // src/domain/scheduled-tasks.ts
 import {
   createScheduledTask,
@@ -2914,13 +3052,20 @@ import { HTTPException as HTTPException10 } from "hono/http-exception";
 
 // src/domain/sessions.ts
 import { CODEX_MODEL_ID_PREFIX } from "@opengeni/codex";
-import { configuredAllowedModels, policyProviderIdForModel } from "@opengeni/config";
+import {
+  canonicalizeConfiguredModelId,
+  configuredAllowedModels,
+  policyProviderIdForModel,
+  resolveTurnExecutionPolicyV1
+} from "@opengeni/config";
 import {
   CreateSessionRequest,
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
   ServiceTurnInitiator,
   ServiceTurnInitiatorContext,
   evaluateWorkspaceModelPolicy,
-  reasoningEffortForMetadata
+  reasoningEffortForMetadata,
+  SessionMcpApprovalPolicy
 } from "@opengeni/contracts";
 import {
   createSession,
@@ -2946,6 +3091,7 @@ import {
   listSessionMcpServersForChildInheritance,
   requireSession as requireSession2,
   submitHumanPromptInTransaction,
+  appendSessionEventsWithLockedSessionUpdate,
   updateSessionTitle as updateSessionTitleRow,
   withWorkspaceSubjectRls,
   QueueCommandConflictError,
@@ -3091,6 +3237,7 @@ function mcpServerConfigFromMetadata(server) {
     ...server.name ? { name: server.name } : {},
     url: server.url,
     cacheToolsList: false,
+    requireApproval: server.requireApproval,
     ...server.connectionRef ? { connectionRef: server.connectionRef } : {}
   };
 }
@@ -3151,6 +3298,7 @@ function validateSessionMcpServersForCreate(settings, grant, servers) {
       url: server.url,
       headerNames: Object.keys(headersEncrypted).sort(),
       credentialVersion: 1,
+      requireApproval: server.requireApproval ?? false,
       connectionRef: server.connectionRef ?? null
     });
   }
@@ -3186,6 +3334,7 @@ function validateInheritedSessionMcpServersForCreate(servers) {
       url: server.url,
       headerNames: Object.keys(server.headersEncrypted ?? {}).sort(),
       credentialVersion: 1,
+      requireApproval: server.requireApproval ?? false,
       connectionRef: server.connectionRef ?? null
     }))
   };
@@ -3250,6 +3399,7 @@ async function createAndStartSession(input) {
       initialTurnInstructions: input.turnInstructions ?? null,
       resources: input.resources,
       tools: input.tools,
+      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
       metadata: sessionMetadata,
       ...input.createdBy ? { createdBy: input.createdBy } : {},
       ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
@@ -3283,6 +3433,7 @@ async function createAndStartSession(input) {
     initialTurnInstructions: input.turnInstructions ?? null,
     resources: input.resources,
     tools: input.tools,
+    ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
     metadata: sessionMetadata,
     ...input.createdBy ? { createdBy: input.createdBy } : {},
     ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
@@ -3335,7 +3486,9 @@ async function finishStartSession(input, session) {
     sessionId: session.id,
     ...input.clientEventId ? { clientEventId: input.clientEventId } : {},
     reasoningEffortFallback: input.reasoningEffort,
+    turnExecutionPolicy: input.turnExecutionPolicy,
     createdEventPayload: {
+      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
       ...input.variableSet ? { variableSetId: input.variableSet.id, variableSetName: input.variableSet.name } : {},
       ...input.sessionMcpServers?.length ? { mcpServers: input.sessionMcpServers } : {}
     },
@@ -3362,31 +3515,42 @@ async function finishStartSession(input, session) {
 function workflowIdForSession(sessionId) {
   return `session-${sessionId}`;
 }
-function assertConfiguredModel(settings, model) {
+function canonicalConfiguredModel(settings, model) {
   if (model === null || model === void 0) {
-    return;
+    return model;
   }
-  if (configuredAllowedModels(settings).includes(model)) {
-    return;
+  const canonicalModel = canonicalizeConfiguredModelId(settings, model);
+  if (configuredAllowedModels(settings).includes(canonicalModel)) {
+    return canonicalModel;
   }
-  if (settings.codexSubscriptionEnabled && model.startsWith(CODEX_MODEL_ID_PREFIX)) {
-    return;
+  if (settings.codexSubscriptionEnabled && canonicalModel.startsWith(CODEX_MODEL_ID_PREFIX)) {
+    return canonicalModel;
   }
   throw new HTTPException9(422, { message: `model is not available: ${model}` });
 }
+function assertConfiguredModel(settings, model) {
+  canonicalConfiguredModel(settings, model);
+}
 async function assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model) {
   if (model === null || model === void 0) {
     return;
   }
+  const canonicalModel = canonicalConfiguredModel(settings, model);
+  if (canonicalModel === null || canonicalModel === void 0) {
+    return;
+  }
   const policy = await getWorkspaceModelPolicy(db, workspaceId);
   if (!policy) {
     return;
   }
-  const providerId = policyProviderIdForModel(settings, model);
-  const verdict = evaluateWorkspaceModelPolicy(policy, { providerId, modelId: model });
+  const providerId = policyProviderIdForModel(settings, canonicalModel);
+  const verdict = evaluateWorkspaceModelPolicy(policy, {
+    providerId,
+    modelId: canonicalModel
+  });
   if (!verdict.allowed) {
     throw new HTTPException9(422, {
-      message: verdict.reason === "provider" ? `model "${model}" is not allowed by this workspace's model policy: provider "${providerId}" is not in the allowed providers` : `model "${model}" is not allowed by this workspace's model policy`
+      message: verdict.reason === "provider" ? `model "${canonicalModel}" is not allowed by this workspace's model policy: provider "${providerId}" is not in the allowed providers` : `model "${canonicalModel}" is not allowed by this workspace's model policy`
     });
   }
 }
@@ -3407,7 +3571,7 @@ function reasoningEffortForSession(metadata, fallback) {
 }
 async function postUserMessageTurn(input) {
   const { db, bus, workflowClient, settings, accountId, workspaceId, sessionId } = input;
-  const requestedModel = input.model ?? null;
+  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
   const requestedReasoningEffort = input.reasoningEffort ?? null;
   assertConfiguredModel(settings, requestedModel);
   await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, requestedModel);
@@ -3437,9 +3601,11 @@ async function postUserMessageTurn(input) {
           turnInstructions: input.turnInstructions ?? null,
           resources: input.resources,
           tools: input.tools,
+          toolsProvided: input.toolsProvided,
           model: requestedModel,
           reasoningEffort: requestedReasoningEffort,
-          reasoningEffortFallback: settings.openaiReasoningEffort,
+          reasoningEffortFallback: input.reasoningEffortFallback ?? settings.openaiReasoningEffort,
+          turnExecutionPolicy: input.turnExecutionPolicy,
           source: input.origin === "operator" ? "api" : "user",
           mcpCredentialUpdates: input.mcpCredentialUpdates ?? []
         })
@@ -3535,12 +3701,50 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   const resources = normalizeResources(
     hasOwnProperty(rawPayload, "resources") ? payload.resources : parentSession?.resources ?? payload.resources
   );
+  const toolsProvided = hasOwnProperty(rawPayload, "tools");
   const requestedTools = validateToolRefs(
-    hasOwnProperty(rawPayload, "tools") ? payload.tools : parentSession?.tools ?? payload.tools,
+    toolsProvided ? payload.tools : parentSession?.tools ?? payload.tools,
     runtimeSettings
   );
-  const defaultedTools = hasOwnProperty(rawPayload, "tools") || parentSession ? requestedTools : withDefaultEnabledCapabilityMcpTools(requestedTools, settings, capabilityRuntimeSettings);
-  const tools = withFirstPartyTools(defaultedTools, runtimeSettings);
+  let selectedTools;
+  let toolPolicy;
+  if (parentSession) {
+    const parentTracksWorkspaceDefaults = parentSession.toolPolicy?.mode === "workspace_default";
+    const parentEffective = withFirstPartyTools(
+      parentTracksWorkspaceDefaults ? withDefaultEnabledCapabilityMcpTools(
+        availableToolRefs(parentSession.tools, runtimeSettings),
+        settings,
+        runtimeSettings
+      ) : parentSession.tools,
+      runtimeSettings
+    );
+    if (toolsProvided) {
+      assertToolRefsSubset(
+        requestedTools,
+        parentEffective,
+        "child tools may only narrow the parent session tool policy"
+      );
+      selectedTools = requestedTools;
+      toolPolicy = { mode: "explicit", inheritedFromSessionId: parentSession.id };
+    } else {
+      selectedTools = parentEffective;
+      toolPolicy = {
+        mode: parentTracksWorkspaceDefaults ? "workspace_default" : "inherited",
+        inheritedFromSessionId: parentSession.id
+      };
+    }
+  } else if (toolsProvided) {
+    selectedTools = requestedTools;
+    toolPolicy = { mode: "explicit", inheritedFromSessionId: null };
+  } else {
+    selectedTools = withDefaultEnabledCapabilityMcpTools(
+      requestedTools,
+      settings,
+      capabilityRuntimeSettings
+    );
+    toolPolicy = { mode: "workspace_default", inheritedFromSessionId: null };
+  }
+  const tools = withFirstPartyTools(selectedTools, runtimeSettings);
   await validateGitHubRepositorySelection(db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
     throw new HTTPException9(503, { message: "object storage is not configured" });
@@ -3568,16 +3772,30 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       frozenRigVersionId = rig.activeVersion.id;
     }
   }
-  assertConfiguredModel(settings, payload.model);
-  await assertWorkspaceModelPolicyAllows(
-    db,
-    settings,
-    workspaceId,
-    payload.model ?? settings.openaiModel
-  );
-  const model = payload.model ?? settings.openaiModel;
+  const model = canonicalConfiguredModel(settings, payload.model ?? settings.openaiModel);
+  if (model === null || model === void 0) {
+    throw new Error("effective session model unexpectedly resolved to null");
+  }
+  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
   const reasoningEffort = payload.reasoningEffort ?? settings.openaiReasoningEffort;
-  let firstPartyMcpPermissions = payload.firstPartyMcpPermissions ?? (parentSessionId ? [...new Set(grant.permissions)] : null);
+  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
+    modelId: model,
+    requestedModelId: payload.model ?? null,
+    modelSource: payload.model === void 0 ? "deployment" : "explicit",
+    reasoningEffort,
+    reasoningSource: payload.reasoningEffort === void 0 ? "deployment" : "explicit"
+  });
+  const parentFirstPartyMcpPermissions = parentSession ? [...parentSession.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS] : null;
+  if (parentFirstPartyMcpPermissions && payload.firstPartyMcpPermissions?.some(
+    (permission) => !hasPermission(parentFirstPartyMcpPermissions, permission)
+  )) {
+    throw new HTTPException9(403, {
+      message: "child first-party MCP permissions may only narrow the parent session grant"
+    });
+  }
+  let firstPartyMcpPermissions = payload.firstPartyMcpPermissions ?? (parentFirstPartyMcpPermissions ? parentFirstPartyMcpPermissions.filter(
+    (permission) => hasPermission(grant.permissions, permission)
+  ) : null);
   if (firstPartyMcpPermissions && firstPartyMcpPermissions.length === 0) {
     throw new HTTPException9(422, {
       message: "firstPartyMcpPermissions must not be empty; omit it for the default worker permission set"
@@ -3710,9 +3928,11 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       turnInstructions: payload.turnInstructions ?? null,
       resources,
       tools,
+      toolPolicy,
       ...payload.clientEventId ? { clientEventId: payload.clientEventId } : {},
       model,
       reasoningEffort,
+      turnExecutionPolicy,
       // A shared spawn inherits the box's backend; a caller-supplied
       // sandboxBackend on a shared spawn is ignored (it is the same box). A
       // machine-targeted top-level create labels the home "selfhosted"
@@ -3777,6 +3997,11 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   return session;
 }
 async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, input) {
+  if (input.toolsProvided && !deps.settings.sessionTurnToolReplacementEnabled) {
+    throw new HTTPException9(503, {
+      message: "explicit follow-up tool replacement is temporarily unavailable until provenance-aware turn workers finish rolling out; omit tools to inherit the session policy and retry"
+    });
+  }
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   await requireSessionAuthorization(deps, grant, {
     sessionId,
@@ -3789,19 +4014,50 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     settings
   );
   const existingSession = await requireSession2(db, workspaceId, sessionId);
+  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
+  const effectiveModel = canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;
+  if (effectiveModel === null) {
+    throw new Error("effective follow-up model unexpectedly resolved to null");
+  }
+  const sessionReasoningEffort = reasoningEffortForSession(
+    existingSession.metadata,
+    settings.openaiReasoningEffort
+  );
+  const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;
+  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
+    modelId: effectiveModel,
+    requestedModelId: input.model ?? null,
+    modelSource: input.model == null ? "session" : "explicit",
+    reasoningEffort: effectiveReasoningEffort,
+    reasoningSource: input.reasoningEffort == null ? "session" : "explicit"
+  });
   const runtimeSettings = settingsWithSessionMcpServerMetadata(
     capabilityRuntimeSettings,
     existingSession.mcpServers
   );
   const requestedResources = normalizeResources(input.resources ?? []);
-  const validatedTools = validateToolRefs(input.tools ?? [], runtimeSettings);
-  const requestedTools = input.toolsProvided ? validatedTools : withDefaultEnabledCapabilityMcpTools(validatedTools, settings, capabilityRuntimeSettings);
+  const tracksWorkspaceDefaults = existingSession.toolPolicy?.mode === "workspace_default";
+  const sessionPolicyTools = withFirstPartyTools(
+    tracksWorkspaceDefaults ? withDefaultEnabledCapabilityMcpTools(
+      availableToolRefs(existingSession.tools, runtimeSettings),
+      settings,
+      capabilityRuntimeSettings
+    ) : existingSession.tools,
+    runtimeSettings
+  );
+  const validatedTools = input.toolsProvided ? validateToolRefsForSessionPolicy({
+    requested: input.tools ?? [],
+    settings: runtimeSettings,
+    allowedTools: sessionPolicyTools,
+    message: "message tools may only narrow the session tool policy"
+  }) : [];
+  const requestedTools = input.toolsProvided ? validatedTools : [];
   await requireLimit(deps, {
     accountId: grant.accountId,
     workspaceId,
     action: "agent_run:create",
     quantity: 1,
-    model: input.model ?? existingSession.model
+    model: effectiveModel
   });
   if (requestedResources.some((resource) => resource.kind === "file") && !objectStorage) {
     throw new HTTPException9(503, { message: "object storage is not configured" });
@@ -3830,8 +4086,11 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     turnInstructions: input.turnInstructions ?? null,
     resources: requestedResources,
     tools: requestedTools,
+    toolsProvided: input.toolsProvided,
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
+    reasoningEffortFallback: sessionReasoningEffort,
+    turnExecutionPolicy,
     mcpCredentialUpdates,
     delivery: input.delivery ?? "send",
     origin: delegatedServiceInitiator ? "operator" : input.origin ?? "human",
@@ -3892,6 +4151,48 @@ async function updateSessionTitle(deps, grant, sessionId, title, source) {
     relatedSessionAccess: authorization?.relatedSessionAccess ?? "root"
   };
 }
+async function updateSessionMcpApprovalPolicy(deps, grant, sessionId, serverId, requireApproval) {
+  const normalizedPolicy = SessionMcpApprovalPolicy.parse(requireApproval);
+  await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.mcp.approval_policy.write",
+    surface: "core"
+  });
+  requirePermission(grant, "sessions:control");
+  const outcome = {};
+  const events = await appendSessionEventsWithLockedSessionUpdate(
+    deps.db,
+    grant.workspaceId,
+    sessionId,
+    async (_session, context) => {
+      const result = await context.updateSessionMcpApprovalPolicy(serverId, normalizedPolicy);
+      if (!result.server) {
+        throw new HTTPException9(404, { message: "session MCP server not found" });
+      }
+      outcome.server = result.server;
+      return {
+        events: result.changed ? [
+          {
+            type: "session.mcp.approval_policy.updated",
+            payload: {
+              serverId,
+              effectiveFrom: "next_attempt"
+            }
+          }
+        ] : []
+      };
+    }
+  );
+  const updatedServer = outcome.server;
+  if (!updatedServer) {
+    throw new Error("session MCP approval policy update returned no server");
+  }
+  await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, events);
+  return {
+    server: updatedServer,
+    effectiveFrom: "next_attempt"
+  };
+}
 async function readSessionLineage(deps, grant, sessionId) {
   const authorization = await requireSessionAuthorization(deps, grant, {
     sessionId,
@@ -4095,13 +4396,8 @@ function manualScheduledTaskTriggerUsageKey(workspaceId, taskId, triggerToken) {
   return `agent_run.created:scheduled-trigger:${workspaceId}:${taskId}:${triggerToken}`;
 }
 async function validateScheduledTaskAgentConfig(input) {
-  assertConfiguredModel(input.settings, input.payload.agentConfig.model);
-  await assertWorkspaceModelPolicyAllows(
-    input.db,
-    input.settings,
-    input.workspaceId,
-    input.payload.agentConfig.model
-  );
+  const model = canonicalConfiguredModel(input.settings, input.payload.agentConfig.model);
+  await assertWorkspaceModelPolicyAllows(input.db, input.settings, input.workspaceId, model);
   const resources = normalizeResources(input.payload.agentConfig.resources ?? []);
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     input.db,
@@ -4121,6 +4417,7 @@ async function validateScheduledTaskAgentConfig(input) {
   await validateFileResources(input.db, input.workspaceId, resources);
   return {
     ...input.payload.agentConfig,
+    ...model === void 0 || model === null ? {} : { model },
     prompt,
     resources,
     tools
@@ -4423,6 +4720,7 @@ function composerDraft(row) {
     text: row.text,
     resources: row.resources,
     tools: row.tools,
+    toolsProvided: row.toolsProvided,
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     sourceTurnId: row.sourceTurnId,
@@ -4641,6 +4939,7 @@ async function getHumanComposerDraft(deps, context) {
     text: "",
     resources: [],
     tools: [],
+    toolsProvided: false,
     model: session.model,
     reasoningEffort: reasoningEffortForMetadata2(session.metadata, "medium"),
     sourceTurnId: null,
@@ -4686,12 +4985,15 @@ export {
   assertAllowedVariableSetVariableName,
   assertConfiguredModel,
   assertPackSandboxImageCompatible,
+  assertToolRefsSubset,
   assertWorkspaceDeletable,
   assertWorkspaceMemberRemovable,
   assertWorkspaceModelPolicyAllows,
+  availableToolRefs,
   buildCapabilityCatalog,
   buildFleetContextForSession,
   buildMarketingDailyAnalysisAgentConfig,
+  canonicalConfiguredModel,
   checkLimit,
   classifyRigVerificationOutcome,
   controlAgentSessionWorkstream,
@@ -4755,6 +5057,7 @@ export {
   requireVariableSetForApi,
   resolveCapabilityPack,
   resolveMemberSubjectId,
+  resolveSessionToolPolicy,
   restoreScheduledTask,
   rigActorForGrant,
   routingEnabled,
@@ -4764,6 +5067,7 @@ export {
   scheduledTaskToolsProvided,
   scheduledTaskTriggerToken,
   sendAgentSessionMessage,
+  sessionWithEffectiveToolPolicy,
   settingsWithEnabledCapabilityMcpServers,
   settingsWithMcpCapabilityServers,
   settingsWithSessionMcpServerMetadata,
@@ -4774,6 +5078,7 @@ export {
   syncCreatedScheduledTask,
   syncUpdatedScheduledTask,
   updateRigForApi,
+  updateSessionMcpApprovalPolicy,
   updateSessionTitle,
   validateFileResources,
   validateGitHubRepositorySelection,
@@ -4781,10 +5086,13 @@ export {
   validateGitHubRepositorySelectionShapes,
   validateMcpCapabilityConnection,
   validateToolRefs,
+  validateToolRefsForSessionPolicy,
   validateVariableSetAttachment,
   validatedScheduledTaskUpdate,
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
+  workspaceSessionToolPolicyDefaultServerIds,
+  workspaceSessionToolPolicyServerIds,
   wrapChannelABoxWithRouting
 };
 //# sourceMappingURL=index.js.map