@opengeni/core 2.7.5-canary.6 → 2.8.0-canary.0

package/dist/domain/pr-review.d.ts

@@ -80,7 +80,7 @@ export declare const prReviewAutomationAdapter: {
                 eager?: boolean | undefined;
                 optional?: boolean | undefined;
             }[];
-            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
             firstPartyMcpPermissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;

package/dist/domain/sessions.d.ts

@@ -1,5 +1,5 @@
 import { type Settings } from "@opengeni/config";
-import { SessionSpawnDenial, type AccessGrant, type ComposerDraft, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type McpConnectionAuthoritySelection, type Permission, type PersonalResourceAttachmentIntent, type ReasoningEffort, type ResourceRef, type Session, type SessionCommandReceipt, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type SubmittedTimelineAnnotation, type TimelineAnnotation, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type SessionPromptRouting, type SessionGoalSnapshot, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1, type VariableSet, type XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
+import { SessionSpawnDenial, type AccessGrant, type ComposerDraft, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type McpConnectionAuthoritySelection, type Permission, type PersonalResourceAttachmentIntent, type ReasoningEffort, type ResourceRef, type Session, type SessionAgentAccess, type SessionCommandReceipt, type SessionEndUser, type SessionMemoryScope, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type SubmittedTimelineAnnotation, type TimelineAnnotation, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type SessionPromptRouting, type SessionGoalSnapshot, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1, type VariableSet, type XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
 import { type CreateSessionMcpServerInput, type Database, type UpdateSessionMcpServerCredentialsInput, type SessionCommandActor, type NewSessionDraftSnapshot } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import { type AccessGrantAuthorization } from "../access/index.js";
@@ -9,11 +9,25 @@ export declare class SessionSpawnDeniedError extends Error {
     readonly denial: SessionSpawnDenial;
     constructor(denial: SessionSpawnDenial);
 }
+/**
+ * A session's effective first-party selection as a ceiling for narrowing:
+ * the stored selection (or the deployment default for a legacy null) under
+ * the deployment ceiling, with the resume counterpart of pause authority the
+ * runtime already grants to existing sessions.
+ */
+export declare function effectiveFirstPartyMcpToolCeiling(stored: readonly FirstPartyMcpToolName[] | null | undefined, policy: {
+    default: readonly FirstPartyMcpToolName[];
+    allowed: readonly FirstPartyMcpToolName[];
+}): Set<FirstPartyMcpToolName>;
 /**
  * Resolve per-session first-party tool visibility without consulting
  * authorization. Top-level omission snapshots the complete runtime default;
  * child omission snapshots the parent's exact effective selection. Explicit
- * [] is authoritative and must never widen.
+ * [] is authoritative and must never widen. An explicit child selection may
+ * only narrow the parent's effective selection: a session that was handed a
+ * reduced catalog cannot spawn a child that sees more than it does. A
+ * top-level explicit selection keeps only the deployment ceiling (checked by
+ * the caller) because there is no creator selection to narrow.
  */
 export declare function resolveFirstPartyMcpToolsForCreate(requested: FirstPartyMcpToolName[] | undefined, parentStored: FirstPartyMcpToolName[] | null | undefined, policy?: {
     default: readonly FirstPartyMcpToolName[];
@@ -133,6 +147,9 @@ export declare function createAndStartSessionWithOutcome(input: {
     policyRole?: string | null;
     firstPartyMcpPermissions?: Permission[] | null;
     firstPartyMcpTools: FirstPartyMcpToolName[];
+    agentAccess?: SessionAgentAccess;
+    endUser?: SessionEndUser | null;
+    memoryScope?: SessionMemoryScope;
     mcpServers?: CreateSessionMcpServerInput[];
     sessionMcpServers?: SessionMcpServerMetadata[];
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
@@ -284,6 +301,32 @@ export declare function resolveSessionCreateVisibility(input: {
     visibilityProvided: boolean;
     parentVisibility: "user_private" | "workspace_shared" | null;
 }): "user_private" | "workspace_shared";
+export type SessionCreateScope = {
+    agentAccess: SessionAgentAccess;
+    endUser: SessionEndUser | null;
+    memoryScope: SessionMemoryScope;
+};
+/**
+ * Resolve a new session's agent-access scope, end-user label, and Memory
+ * selector (migration 0427). A top-level request takes its own values. An
+ * agent-created child inherits every omitted value from its trusted parent
+ * and may only NARROW an explicit one: agent access workspace > user >
+ * session, memory workspace > user > session > off, and the label must equal
+ * the parent's. Widening is a 403 because the parent's declared reach is a
+ * security boundary the child's own request cannot cross; a memory `user`
+ * selector without a label is a 422 in either position.
+ */
+export declare function resolveSessionCreateScope(input: {
+    requested: {
+        agentAccess: SessionAgentAccess;
+        agentAccessProvided: boolean;
+        endUser: SessionEndUser | null;
+        endUserProvided: boolean;
+        memoryScope: SessionMemoryScope;
+        memoryScopeProvided: boolean;
+    };
+    parent: SessionCreateScope | null;
+}): SessionCreateScope;
 export declare function createSessionForRequestWithOutcome(unresolvedDeps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, rawPayload: unknown, authorization?: AccessGrantAuthorization, agentChildPresentation?: AgentChildSessionCreatePresentation): Promise<CreateSessionRequestOutcome>;
 /** @internal Fixed public projection; the committed session outcome remains authoritative. */
 export declare function reportSessionUsageRecordingFailure(_error: unknown): void;

package/dist/index.d.ts

@@ -53,3 +53,4 @@ export * from "./application/user-resource-grants.js";
 export * from "./application/api-integration-servers.js";
 export * from "./editable-artifact-live.js";
 export * from "./editable-artifacts.js";
+export { withSiteSessionOrigin } from "./site-session-origin.js";

package/dist/index.js

@@ -209,6 +209,7 @@ function filenameForMimeType(mimeType) {
 }
 
 // src/model-catalog.ts
+import { modelAllowedByConnections } from "@opengeni/db";
 import {
   applyModelCatalogDocument,
   configuredGatewayWorkspaceProductModelIds,
@@ -662,7 +663,7 @@ function resolveWorkspaceModelSelection(input) {
     const policyAllowed = evaluateWorkspaceModelPolicy(input.policy, {
       providerId: model.providerId,
       modelId: model.id
-    }).allowed;
+    }).allowed && modelAllowedByConnections(input.connectionModelRestrictions ?? {}, model.id);
     const credentialReadiness = credentialReadinessFor({
       model,
       provider,
@@ -2430,6 +2431,35 @@ var SessionAuthorizationUnavailableError = class extends Error {
     this.name = "SessionAuthorizationUnavailableError";
   }
 };
+function sameEndUser(left, right) {
+  return left !== null && right !== null && left.source === right.source && left.id === right.id;
+}
+function agentAccessPermitsCrossTreeAccess(caller, target) {
+  if (caller.agentAccess === "session" || target.agentAccess === "session") return false;
+  if (caller.agentAccess === "user" || target.agentAccess === "user") {
+    return sameEndUser(caller.endUser, target.endUser);
+  }
+  return true;
+}
+function agentAccessListScopeForViewer(viewer, hostScope = null) {
+  if (viewer.agentAccess === "session" && (!hostScope || hostScope.kind === "all")) {
+    return {
+      kind: "scoped",
+      rootSessionIds: [viewer.callerRootSessionId],
+      sessionIds: [],
+      agentAccessViewer: viewer
+    };
+  }
+  if (!hostScope || hostScope.kind === "all") {
+    return { kind: "all", agentAccessViewer: viewer };
+  }
+  return {
+    kind: "scoped",
+    rootSessionIds: [...new Set(hostScope.rootSessionIds)],
+    sessionIds: [...new Set(hostScope.sessionIds)],
+    agentAccessViewer: viewer
+  };
+}
 function grantHasAgentAttemptAuthority(grant) {
   const hasAgentAttemptClaim = grant.metadata?.["turnId"] !== void 0 || grant.metadata?.["attemptId"] !== void 0 || grant.metadata?.["executionGeneration"] !== void 0;
   return grant.principalKind ? grant.principalKind === "agent_attempt" : hasAgentAttemptClaim;
@@ -2486,6 +2516,15 @@ async function requireSessionAuthorization(deps, grant, input) {
     const allowed = actor.kind === "subject" ? actor.subjectId === slackAccess.owningSubjectId : actor.callerRootSessionId === target.rootSessionId;
     if (!allowed) throw new SessionAuthorizationDeniedError("forbidden");
   }
+  if (actor.kind === "agent_attempt" && target.rootSessionId !== actor.callerRootSessionId) {
+    const callerAccess = resolvedActor.callerAccess;
+    if (!callerAccess || !agentAccessPermitsCrossTreeAccess(callerAccess, {
+      agentAccess: authority.agentAccess,
+      endUser: authority.endUser
+    })) {
+      throw new SessionAuthorizationDeniedError("forbidden");
+    }
+  }
   if (!port) {
     return {
       actor,
@@ -2525,8 +2564,13 @@ async function requireSessionAuthorizationListScope(deps, grant, surface) {
   const port = deps.sessionAuthorization;
   const isAgentAttempt = grantHasAgentAttemptAuthority(grant);
   if (!port && !isAgentAttempt) return null;
-  const { actor } = await resolveSessionAuthorizationActor(deps.db, grant);
-  if (!port) return null;
+  const { actor, callerAccess } = await resolveSessionAuthorizationActor(deps.db, grant);
+  const viewer = actor.kind === "agent_attempt" && callerAccess ? {
+    callerRootSessionId: actor.callerRootSessionId,
+    agentAccess: callerAccess.agentAccess,
+    endUser: callerAccess.endUser
+  } : null;
+  if (!port) return viewer ? agentAccessListScopeForViewer(viewer) : null;
   let rawScope;
   try {
     rawScope = await port.resolveListScope({
@@ -2542,12 +2586,12 @@ async function requireSessionAuthorizationListScope(deps, grant, surface) {
   if (!parsed.success) {
     throw new SessionAuthorizationUnavailableError({ cause: parsed.error });
   }
-  if (parsed.data.kind === "all") return parsed.data;
-  return {
+  const hostScope = parsed.data.kind === "all" ? { kind: "all" } : {
     kind: "scoped",
     rootSessionIds: [...new Set(parsed.data.rootSessionIds)],
     sessionIds: [...new Set(parsed.data.sessionIds)]
   };
+  return viewer ? agentAccessListScopeForViewer(viewer, hostScope) : hostScope;
 }
 async function resolveSessionAuthorizationTarget(db, grant, sessionId) {
   const session = await getSession(db, grant.workspaceId, sessionId);
@@ -2572,7 +2616,8 @@ async function resolveSessionAuthorizationActor(db, grant) {
         subjectId: grant.subjectId,
         ...grant.subjectLabel ? { subjectLabel: grant.subjectLabel } : {}
       }),
-      callerParentSessionId: null
+      callerParentSessionId: null,
+      callerAccess: null
     };
   }
   if (typeof callerSessionId !== "string" || typeof turnId !== "string" || typeof attemptId !== "string" || typeof executionGeneration !== "number" || !Number.isSafeInteger(executionGeneration) || executionGeneration < 1) {
@@ -2598,7 +2643,8 @@ async function resolveSessionAuthorizationActor(db, grant) {
       initiatorContext: turn.initiatorContext,
       initiatingHumanSubjectId: turn.initiatingHumanSubjectId ?? (turn.initiator.kind === "subject" ? turn.initiator.subjectId : null)
     }),
-    callerParentSessionId: callerSession.parentSessionId
+    callerParentSessionId: callerSession.parentSessionId,
+    callerAccess: { agentAccess: callerSession.agentAccess, endUser: callerSession.endUser }
   };
 }
 
@@ -6885,7 +6931,7 @@ function withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings)
   return mergeToolRefs(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));
 }
 function withWorkspaceDefaultMcpTools(tools, settings, runtimeSettings, defaults) {
-  if (!defaults) {
+  if (!defaults?.mcpServerIds) {
     return withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings);
   }
   return mergeToolRefs(
@@ -8178,7 +8224,7 @@ async function workspaceSessionToolPolicyDefaultServerIds(db, workspaceId, setti
   const availableDefaults = defaultSessionMcpServerIds(runtimeSettings.mcpServers);
   const workspace = await requireWorkspace2(db, workspaceId);
   const configured = resolveWorkspaceSessionToolDefaults(workspace.settings);
-  if (!configured) return availableDefaults;
+  if (!configured?.mcpServerIds) return availableDefaults;
   const available = new Set(availableDefaults);
   return sortedIds(configured.mcpServerIds.filter((id) => available.has(id)));
 }
@@ -8199,11 +8245,17 @@ function sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDe
 }
 
 // src/domain/scheduled-tasks.ts
-import { resolveFirstPartyMcpToolPolicy as resolveFirstPartyMcpToolPolicy2 } from "@opengeni/config";
+import {
+  allowedFirstPartyMcpToolsForSession,
+  resolveFirstPartyMcpToolPolicy as resolveFirstPartyMcpToolPolicy2
+} from "@opengeni/config";
 import {
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS as DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY as OPENGENI_SLACK_BOT_SESSION_METADATA_KEY3,
-  resolveWorkspaceSessionToolDefaults as resolveWorkspaceSessionToolDefaults3
+  resolveWorkspaceSessionToolDefaults as resolveWorkspaceSessionToolDefaults3,
+  SessionAgentAccess,
+  SessionEndUser,
+  SessionMemoryScope
 } from "@opengeni/contracts";
 import {
   createScheduledTask,
@@ -8233,6 +8285,20 @@ import { isDeepStrictEqual } from "util";
 
 // src/domain/sessions.ts
 import { CODEX_MODEL_ID_PREFIX, isCodexBilledModel } from "@opengeni/codex";
+
+// src/site-session-origin.ts
+import { AsyncLocalStorage } from "async_hooks";
+var origins = new AsyncLocalStorage();
+function withSiteSessionOrigin(origin, run) {
+  return origins.run(origin, run);
+}
+function sessionCreationMetadata(metadata) {
+  const { _opengeniSiteOrigin: _ignored, ...rest } = metadata;
+  const origin = origins.getStore();
+  return origin ? { ...rest, _opengeniSiteOrigin: origin } : rest;
+}
+
+// src/domain/sessions.ts
 import {
   canonicalizeConfiguredModelId,
   configuredAllowedModels,
@@ -8872,11 +8938,28 @@ var SessionSpawnDeniedError = class extends Error {
     this.denial = denial;
   }
 };
+function effectiveFirstPartyMcpToolCeiling(stored, policy) {
+  const allowed = new Set(policy.allowed);
+  const ceiling = new Set([...stored ?? policy.default].filter((tool) => allowed.has(tool)));
+  if (ceiling.has("goal_pause") && allowed.has("goal_resume")) ceiling.add("goal_resume");
+  return ceiling;
+}
 function resolveFirstPartyMcpToolsForCreate(requested, parentStored, policy = {
   default: DEFAULT_FIRST_PARTY_MCP_TOOLS,
   allowed: FIRST_PARTY_MCP_TOOL_NAMES2
 }) {
-  if (requested !== void 0) return [...requested];
+  if (requested !== void 0) {
+    if (parentStored !== void 0) {
+      const parentCeiling = effectiveFirstPartyMcpToolCeiling(parentStored, policy);
+      const widened = requested.find((tool) => !parentCeiling.has(tool));
+      if (widened) {
+        throw new HTTPException12(403, {
+          message: `child first-party MCP tools may only narrow the parent session selection: ${widened}`
+        });
+      }
+    }
+    return [...requested];
+  }
   const allowed = new Set(policy.allowed);
   const inherited = parentStored === void 0 ? policy.default : parentStored ?? policy.default;
   return [...inherited].filter((tool) => allowed.has(tool));
@@ -9299,6 +9382,9 @@ async function createAndStartSessionWithOutcome(input) {
       firstPartyMcpTools: input.firstPartyMcpTools,
       instructions: input.instructions ?? null,
       policyRole: input.policyRole ?? null,
+      ...input.agentAccess ? { agentAccess: input.agentAccess } : {},
+      ...input.endUser !== void 0 ? { endUser: input.endUser } : {},
+      ...input.memoryScope ? { memoryScope: input.memoryScope } : {},
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey: input.createIdempotencyKey,
       selectedInstalledSkillIds: input.selectedInstalledSkillIds ?? [],
@@ -9380,6 +9466,9 @@ async function createAndStartSessionWithOutcome(input) {
       firstPartyMcpTools: input.firstPartyMcpTools,
       instructions: input.instructions ?? null,
       policyRole: input.policyRole ?? null,
+      ...input.agentAccess ? { agentAccess: input.agentAccess } : {},
+      ...input.endUser !== void 0 ? { endUser: input.endUser } : {},
+      ...input.memoryScope ? { memoryScope: input.memoryScope } : {},
       parentSessionId: input.parentSessionId ?? null,
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
@@ -9665,7 +9754,7 @@ async function postUserMessageTurn(input) {
   const requestedReasoningEffort = input.reasoningEffort ?? null;
   assertConfiguredModel(settings, requestedModel);
   const sessionForModelGate = await requireSession2(db, workspaceId, sessionId);
-  const effectiveModelForGate = requestedModel ?? sessionForModelGate.model;
+  const effectiveModelForGate = input.turnExecutionPolicy?.productModelId ?? requestedModel ?? sessionForModelGate.model;
   const freshWorkspaceCustomModel = requestedModel !== null && isWorkspaceCustomModelId(settings, requestedModel) && requestedModel !== sessionForModelGate.model ? requestedModel : null;
   await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, effectiveModelForGate);
   try {
@@ -9797,6 +9886,54 @@ function resolveSessionCreateVisibility(input) {
   }
   return input.requestedVisibility === "private" ? "user_private" : "workspace_shared";
 }
+var AGENT_ACCESS_WIDTH = {
+  session: 0,
+  user: 1,
+  workspace: 2
+};
+var MEMORY_SCOPE_WIDTH = {
+  off: 0,
+  session: 1,
+  user: 2,
+  workspace: 3
+};
+function resolveSessionCreateScope(input) {
+  const { requested, parent } = input;
+  let resolved;
+  if (!parent) {
+    resolved = {
+      agentAccess: requested.agentAccess,
+      endUser: requested.endUser,
+      memoryScope: requested.memoryScope
+    };
+  } else {
+    const agentAccess = requested.agentAccessProvided ? requested.agentAccess : parent.agentAccess;
+    if (AGENT_ACCESS_WIDTH[agentAccess] > AGENT_ACCESS_WIDTH[parent.agentAccess]) {
+      throw new HTTPException12(403, {
+        message: "child agent access may only narrow the parent session"
+      });
+    }
+    if (requested.endUserProvided) {
+      const same = requested.endUser !== null && parent.endUser !== null && requested.endUser.source === parent.endUser.source && requested.endUser.id === parent.endUser.id;
+      if (!same) {
+        throw new HTTPException12(403, {
+          message: "child end-user label must equal the parent session label"
+        });
+      }
+    }
+    const memoryScope = requested.memoryScopeProvided ? requested.memoryScope : parent.memoryScope;
+    if (MEMORY_SCOPE_WIDTH[memoryScope] > MEMORY_SCOPE_WIDTH[parent.memoryScope]) {
+      throw new HTTPException12(403, {
+        message: "child memory scope may only narrow the parent session"
+      });
+    }
+    resolved = { agentAccess, endUser: parent.endUser, memoryScope };
+  }
+  if (resolved.memoryScope === "user" && resolved.endUser === null) {
+    throw new HTTPException12(422, { message: 'memoryScope "user" requires an endUser label' });
+  }
+  return resolved;
+}
 async function resolveWorkspaceModelBoundarySettings(deps, grant, workspaceId, modelIds, retainedProductModelId) {
   const retainedCatalogModel = isCatalogOverlayModel(retainedProductModelId);
   if (deps.catalogSourceSettings) {
@@ -9838,6 +9975,7 @@ async function withSessionCreateUsageRecording(input) {
 }
 async function createSessionForRequestWithOutcome(unresolvedDeps, grant, workspaceId, rawPayload, authorization, agentChildPresentation) {
   const payload = CreateSessionRequest.parse(rawPayload);
+  payload.metadata = sessionCreationMetadata(payload.metadata);
   if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
     throw new HTTPException12(422, {
       message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY2} is reserved for scheduler routing`
@@ -9899,6 +10037,21 @@ async function createSessionForRequestWithOutcome(unresolvedDeps, grant, workspa
       message: error instanceof Error ? error.message : "invalid child visibility"
     });
   }
+  const sessionScope = resolveSessionCreateScope({
+    requested: {
+      agentAccess: payload.agentAccess,
+      agentAccessProvided: hasOwnProperty(rawPayload, "agentAccess"),
+      endUser: payload.endUser ?? null,
+      endUserProvided: hasOwnProperty(rawPayload, "endUser"),
+      memoryScope: payload.memoryScope,
+      memoryScopeProvided: hasOwnProperty(rawPayload, "memoryScope")
+    },
+    parent: parentAuthority ? {
+      agentAccess: parentAuthority.agentAccess,
+      endUser: parentAuthority.endUser,
+      memoryScope: parentAuthority.memoryScope
+    } : null
+  });
   const creationInitiator = creationInitiatorForGrant(grant);
   const parentCallingTurn = parentSession && creationInitiator.actor ? await getSessionTurnForAttempt2(
     db,
@@ -10276,7 +10429,7 @@ async function createSessionForRequestWithOutcome(unresolvedDeps, grant, workspa
       message: `first-party MCP tool is disabled by deployment policy: ${disallowedFirstPartyMcpTool}`
     });
   }
-  const workspaceFirstPartyDefaults = workspaceSessionToolDefaults?.firstPartyMcpTools.filter(
+  const workspaceFirstPartyDefaults = workspaceSessionToolDefaults?.firstPartyMcpTools?.filter(
     (tool) => deploymentFirstPartyMcpToolPolicy.allowed.includes(tool)
   );
   const firstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(
@@ -10502,6 +10655,9 @@ async function createSessionForRequestWithOutcome(unresolvedDeps, grant, workspa
       // time. Not surfaced as an event.
       instructions: payload.instructions ?? null,
       policyRole: payload.policyRole ?? null,
+      agentAccess: sessionScope.agentAccess,
+      endUser: sessionScope.endUser,
+      memoryScope: sessionScope.memoryScope,
       firstPartyMcpPermissions,
       firstPartyMcpTools,
       mcpServers: sessionMcpServers.dbServers,
@@ -10995,6 +11151,7 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
     surface: "core"
   });
   requirePermission(grant, "sessions:control");
+  const agentAttemptCaller = grantHasAgentAttemptAuthority(grant);
   const existingSession = await requireSession2(deps.db, grant.workspaceId, sessionId);
   const workspace = await requireWorkspace3(deps.db, grant.workspaceId);
   const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults2(workspace.settings);
@@ -11043,7 +11200,7 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
     runtimeSettings
   );
   const workspaceDefaultFirstPartyTools = [
-    ...workspaceSessionToolDefaults?.firstPartyMcpTools.filter(
+    ...workspaceSessionToolDefaults?.firstPartyMcpTools?.filter(
       (tool) => deploymentFirstPartyMcpToolPolicy.allowed.includes(tool)
     ) ?? deploymentFirstPartyMcpToolPolicy.default
   ];
@@ -11120,6 +11277,35 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
         nextTools = requestedMode === "workspace_default" ? workspaceDefaultTools : explicitRequestedTools;
         nextFirstPartyMcpTools = requestedMode === "workspace_default" ? workspaceDefaultFirstPartyTools : explicitRequestedFirstPartyTools;
         nextPolicy = { mode: requestedMode, inheritedFromSessionId: null };
+        if (agentAttemptCaller) {
+          const sessionTracksWorkspaceDefaults = session.toolPolicy?.mode === "workspace_default";
+          const currentEffectiveTools = withFirstPartyTools(
+            sessionTracksWorkspaceDefaults ? withWorkspaceDefaultMcpTools(
+              availableToolRefs(session.tools, runtimeSettings),
+              deps.settings,
+              runtimeSettings,
+              workspaceSessionToolDefaults
+            ) : session.tools,
+            runtimeSettings
+          );
+          assertToolRefsSubset(
+            nextTools,
+            currentEffectiveTools,
+            "an agent may only narrow its session tool policy"
+          );
+          const currentFirstPartyCeiling = effectiveFirstPartyMcpToolCeiling(
+            session.firstPartyMcpTools,
+            deploymentFirstPartyMcpToolPolicy
+          );
+          const widenedFirstPartyTool = nextFirstPartyMcpTools.find(
+            (tool) => !currentFirstPartyCeiling.has(tool)
+          );
+          if (widenedFirstPartyTool) {
+            throw new HTTPException12(403, {
+              message: `an agent may only narrow its session OpenGeni tools: ${widenedFirstPartyTool}`
+            });
+          }
+        }
       }
       const currentPolicy = session.toolPolicy;
       const unchanged = stableJson4({
@@ -11312,6 +11498,12 @@ async function createValidatedScheduledTask(input) {
     ...scheduledConnectionSurfaceEligibility(runtimeSettings, target)
   });
   const creationInitiator = creationInitiatorForGrant(input.grant);
+  const creatorPolicy = creationInitiator.actor ? await frozenScheduledTaskCreatorPolicy({
+    db: input.db,
+    settings: input.settings,
+    grant: input.grant,
+    sessionId: creationInitiator.actor.sessionId
+  }) : null;
   const xaiProviderAccountAuthoritySnapshot = creationInitiator.actor ? await getSessionTurnXaiProviderAccountAuthoritySnapshot2(
     input.db,
     input.grant.workspaceId,
@@ -11345,6 +11537,7 @@ async function createValidatedScheduledTask(input) {
       createdByActor: creationInitiator.actor ?? null,
       personalConnectionDelegations,
       xaiProviderAccountAuthoritySnapshot,
+      creatorPolicy,
       targetSessionId: target?.id ?? null,
       variableSetId: input.payload.variableSetId ?? null,
       rigId: input.payload.rigId ?? null,
@@ -11353,6 +11546,37 @@ async function createValidatedScheduledTask(input) {
     })
   );
 }
+async function frozenScheduledTaskCreatorPolicy(input) {
+  const session = await getSession3(input.db, input.grant.workspaceId, input.sessionId);
+  if (!session) {
+    throw new HTTPException13(403, {
+      message: "the calling agent session is not available in this workspace"
+    });
+  }
+  const firstPartyMcpTools = allowedFirstPartyMcpToolsForSession(
+    input.settings,
+    session.firstPartyMcpTools
+  );
+  const firstPartyMcpPermissions = (session.firstPartyMcpPermissions ?? [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2]).filter((permission) => hasPermission(input.grant.permissions, permission));
+  if (firstPartyMcpPermissions.length === 0) {
+    throw new HTTPException13(403, {
+      message: "the calling agent session holds no first-party MCP permission it could delegate to scheduled runs"
+    });
+  }
+  const projection = session;
+  const agentAccess = SessionAgentAccess.safeParse(projection["agentAccess"]);
+  const endUser = SessionEndUser.safeParse(projection["endUser"]);
+  const memoryScope = SessionMemoryScope.safeParse(projection["memoryScope"]);
+  return {
+    firstPartyMcpTools,
+    firstPartyMcpPermissions,
+    sessionPolicy: {
+      agentAccess: agentAccess.success ? agentAccess.data : null,
+      endUser: endUser.success ? { source: endUser.data.source, id: endUser.data.id } : null,
+      memoryScope: memoryScope.success ? memoryScope.data : null
+    }
+  };
+}
 function nestedPostgresMessage(error) {
   const queue = [error];
   const seen = /* @__PURE__ */ new Set();
@@ -16426,6 +16650,8 @@ export {
   accessGrantAuthorizationFromContext,
   accountScopedApiKeyWorkspaceAuthority,
   activateRigVersionForApi,
+  agentAccessListScopeForViewer,
+  agentAccessPermitsCrossTreeAccess,
   apiIntegrationsMatchingDelegations,
   appendRigSetupCommand,
   applyCapabilityEnablement,
@@ -16544,6 +16770,7 @@ export {
   editableArtifactStateHash,
   editableArtifactStorePortFromPostgres,
   editableArtifactTransactionId,
+  effectiveFirstPartyMcpToolCeiling,
   enableCapability,
   enabledCapabilityMcpToolRefs,
   encodeEditableArtifactBrokerHint,
@@ -16574,6 +16801,7 @@ export {
   governedLearningEvidenceIsSlackDerived,
   governedLearningSlackImportance,
   governedLearningSlackProjection,
+  grantHasAgentAttemptAuthority,
   hasLiteralPermission,
   hasPermission,
   hasReservedFikenMetadata,
@@ -16715,6 +16943,7 @@ export {
   resolveMemberSubjectId,
   resolveRigProviderImageForRun,
   resolveRigProviderImageSelection,
+  resolveSessionCreateScope,
   resolveSessionCreateVisibility,
   resolveSessionSandboxRuntime,
   resolveSessionToolPolicy,
@@ -16807,6 +17036,7 @@ export {
   withFrozenPersonalConnectionDelegations,
   withResolvedSessionAuthorization,
   withScheduledTaskAuthorityWriteErrors,
+  withSiteSessionOrigin,
   withWorkspaceDefaultMcpTools,
   workflowIdForSession,
   workspaceCustomModelReference,