@opengeni/core 4.0.0 → 4.0.1

package/dist/index.js

@@ -1,3 +1,15 @@
+import {
+  ManagedAuthActorLeaseOutcomeUnknownError,
+  getManagedAuthRequestActorAbortSignal,
+  getManagedAuthRequestActorAdmissionStamp,
+  getManagedAuthRequestActorEpoch,
+  getManagedAuthRequestActorLeaseStamp,
+  getManagedSession,
+  markManagedAuthRequestActorTransitionApplied,
+  releaseManagedAuthRequestActorLease,
+  validateManagedAuthRequestActorLease
+} from "./chunk-OF65T3PM.js";
+import "./chunk-QO5GVFFO.js";
 import {
   EDITABLE_ARTIFACT_HINT_MAX_BYTES,
   EDITABLE_ARTIFACT_HINT_SUBJECT_PREFIX,
@@ -26,18 +38,6 @@ import {
   encodeEditableArtifactLiveServerWireFrame,
   inspectEditableArtifactLiveWireEnvelope
 } from "./chunk-ZYCNLYGH.js";
-import {
-  ManagedAuthActorLeaseOutcomeUnknownError,
-  getManagedAuthRequestActorAbortSignal,
-  getManagedAuthRequestActorAdmissionStamp,
-  getManagedAuthRequestActorEpoch,
-  getManagedAuthRequestActorLeaseStamp,
-  getManagedSession,
-  markManagedAuthRequestActorTransitionApplied,
-  releaseManagedAuthRequestActorLease,
-  validateManagedAuthRequestActorLease
-} from "./chunk-OF65T3PM.js";
-import "./chunk-QO5GVFFO.js";
 import {
   EDITABLE_ARTIFACT_EXPORT_MAX_DOWNLOAD_BYTES,
   EDITABLE_ARTIFACT_EXPORT_MAX_OPTIONS_BYTES,
@@ -1501,6 +1501,7 @@ import {
   configuredGatewayWorkspaceProductModelIds,
   configuredGatewayOrganizationProductModelIds,
   configuredModels,
+  isModelAvailableForNewSelection,
   configuredModelNotes,
   configuredOpenRouterWorkspaceProductModelIds,
   configuredOpenRouterOrganizationProductModelIds,
@@ -1944,7 +1945,7 @@ function resolveWorkspaceModelSelection(input) {
   const requestedNowMs = input.now?.getTime();
   const nowMs = typeof requestedNowMs === "number" && Number.isFinite(requestedNowMs) ? requestedNowMs : Date.now();
   const maxAgeMs = typeof input.credentialReadinessMaxAgeMs === "number" && Number.isFinite(input.credentialReadinessMaxAgeMs) && input.credentialReadinessMaxAgeMs >= 0 ? input.credentialReadinessMaxAgeMs : MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS;
-  return configuredModels(catalogSettings).map((model) => {
+  return configuredModels(catalogSettings).filter((model) => isModelAvailableForNewSelection(catalogSettings, model.id)).map((model) => {
     const provider = providers.get(model.providerId);
     const policyAllowed = evaluateWorkspaceModelPolicy(input.policy, {
       providerId: model.providerId,
@@ -2462,6 +2463,21 @@ function managedSessionGroupBackend(deploymentBackend, sessionBackend) {
   const backend = sessionBackend === "selfhosted" ? deploymentBackend : sessionBackend;
   return backend === "none" || backend === "selfhosted" ? null : backend;
 }
+var SESSION_GROUP_MACHINE_NAMES = {
+  local: "this computer",
+  docker: "Docker",
+  modal: "Modal",
+  daytona: "Daytona",
+  runloop: "Runloop",
+  e2b: "E2B",
+  blaxel: "Blaxel",
+  cloudflare: "Cloudflare",
+  vercel: "Vercel",
+  opensandbox: "OpenSandbox"
+};
+function sessionGroupMachinePresentation(backend) {
+  return { name: SESSION_GROUP_MACHINE_NAMES[backend], kind: backend };
+}
 function managedSessionGroupOs(sessionBackend, sessionOs) {
   return sessionBackend === "selfhosted" ? "linux" : sessionOs;
 }
@@ -2671,10 +2687,11 @@ async function listFleet(services, ctx) {
       groupLease && (groupLease.recovery.restore.status === "degraded" || groupLease.recovery.restore.status === "unrecoverable" || groupLease.recovery.workspace.status === "degraded" || groupLease.recovery.workspace.status === "unrecoverable")
     );
     const groupOperationAvailability = groupOnline ? "ready" : groupRecoveryUnavailable ? "unavailable" : groupRecovering ? "recovering" : "wakeable";
+    const presentation = sessionGroupMachinePresentation(groupBackend);
     entries.push({
       id: ctx.sessionGroupId,
-      kind: groupBackend === "opensandbox" ? "opensandbox" : "modal",
-      name: "session sandbox",
+      kind: presentation.kind,
+      name: presentation.name,
       liveness: groupOnline ? "online" : groupRecovering ? "reconnecting" : "offline",
       active: groupActive,
       isSessionGroup: true,
@@ -3666,6 +3683,7 @@ function sessionCreationMetadata(metadata) {
 import {
   canonicalizeConfiguredModelId,
   configuredAllowedModels,
+  withCodexCatalogProvider as withCodexCatalogProvider2,
   ORGANIZATION_GATEWAY_MODEL_ID_PREFIX as ORGANIZATION_GATEWAY_MODEL_ID_PREFIX2,
   ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX as ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX2,
   resolveFirstPartyMcpToolPolicy,
@@ -3691,7 +3709,7 @@ import {
   ServiceTurnInitiatorContext,
   evaluateWorkspaceModelPolicy as evaluateWorkspaceModelPolicy2,
   normalizeAutomaticSessionTitle,
-  resolveWorkspaceSessionToolDefaults,
+  resolveWorkspaceSessionToolDefaults as resolveWorkspaceSessionToolDefaults2,
   metadataWithTurnExecutionPolicyV1,
   readTurnExecutionPolicyV1,
   stableJson as stableJson3,
@@ -3726,7 +3744,7 @@ import {
   getSessionTurnPersonalConnectionDelegations as getSessionTurnPersonalConnectionDelegations2,
   getSessionTurnXaiProviderAccountAuthoritySnapshot,
   getWorkspaceModelPolicy,
-  requireWorkspace as requireWorkspace3,
+  requireWorkspace as requireWorkspace4,
   initializeSessionStartAtomically,
   listSessionTurns,
   listSessionMcpServersForChildInheritance,
@@ -5580,6 +5598,153 @@ function storedConnectionRef(config) {
   return !!ref && typeof ref === "object" && !Array.isArray(ref) && typeof ref.providerDomain === "string";
 }
 
+// src/domain/session-tool-policy.ts
+import {
+  SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
+  SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH,
+  mergeToolRefs,
+  resolveWorkspaceSessionToolDefaults
+} from "@opengeni/contracts";
+import { requireWorkspace as requireWorkspace3 } from "@opengeni/db";
+var MANDATORY_SESSION_MCP_SERVER_IDS = ["opengeni"];
+var PROJECTABLE_REGISTRY_ID = /^[A-Za-z0-9_-]+$/;
+function sortedIds(ids) {
+  return [...new Set(ids)].sort();
+}
+function defaultSessionMcpServerIds(servers) {
+  const mandatory = new Set(MANDATORY_SESSION_MCP_SERVER_IDS);
+  return sortedIds([...servers].map((server) => server.id).filter((id) => !mandatory.has(id)));
+}
+function projectIds(ids) {
+  const projectable = ids.filter(
+    (id) => id.length <= SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH && PROJECTABLE_REGISTRY_ID.test(id)
+  );
+  return {
+    ids: projectable.slice(0, SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT),
+    truncated: projectable.length !== ids.length || projectable.length > SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT
+  };
+}
+function resolveSessionToolPolicy(input) {
+  const policy = input.toolPolicy;
+  const availableIds = new Set(input.availableMcpServerIds);
+  const defaultIds = new Set(input.defaultMcpServerIds ?? []);
+  const mandatoryIds = MANDATORY_SESSION_MCP_SERVER_IDS.filter(
+    (id) => availableIds.has(id)
+  );
+  const mandatoryIdSet = new Set(mandatoryIds);
+  const tracksWorkspaceDefaults = policy.mode === "workspace_default";
+  const excludedIds = new Set(tracksWorkspaceDefaults ? policy.excludedMcpServerIds : []);
+  const selectedRefs = mergeToolRefs([], input.sessionTools).filter(
+    (tool) => !excludedIds.has(tool.id) || mandatoryIdSet.has(tool.id)
+  );
+  let toolRefs = selectedRefs.filter((tool) => availableIds.has(tool.id));
+  if (tracksWorkspaceDefaults) {
+    toolRefs = mergeToolRefs(
+      toolRefs,
+      sortedIds(defaultIds).filter((id) => availableIds.has(id) && !excludedIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true }))
+    );
+  }
+  toolRefs = mergeToolRefs(
+    toolRefs,
+    mandatoryIds.map((id) => ({ kind: "mcp", id }))
+  );
+  const requestedEffectiveRefs = mergeToolRefs(
+    selectedRefs,
+    tracksWorkspaceDefaults ? sortedIds(defaultIds).filter((id) => availableIds.has(id) && !excludedIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true })) : []
+  );
+  const effectiveIds = sortedIds(
+    mergeToolRefs(
+      requestedEffectiveRefs,
+      mandatoryIds.map((id) => ({ kind: "mcp", id }))
+    ).map((tool) => tool.id)
+  );
+  const configuredIds = effectiveIds.filter((id) => availableIds.has(id));
+  const configuredIdSet = new Set(configuredIds);
+  const droppedIds = effectiveIds.filter((id) => !configuredIdSet.has(id));
+  const deferredIds = sortedIds(
+    toolRefs.filter((tool) => configuredIdSet.has(tool.id) && tool.eager !== true).map((tool) => tool.id)
+  );
+  const selectedIds = sortedIds(
+    selectedRefs.filter(
+      (tool) => !mandatoryIdSet.has(tool.id) && !(tracksWorkspaceDefaults && tool.optional === true)
+    ).map((tool) => tool.id)
+  );
+  const projections = {
+    selected: projectIds(selectedIds),
+    effective: projectIds(effectiveIds),
+    mandatory: projectIds(sortedIds(mandatoryIds)),
+    deferred: projectIds(deferredIds),
+    configured: projectIds(configuredIds),
+    dropped: projectIds(droppedIds)
+  };
+  return {
+    toolRefs,
+    effectivePolicy: {
+      mode: policy.mode,
+      inheritedFromSessionId: policy.inheritedFromSessionId,
+      selectedIds: projections.selected.ids,
+      effectiveIds: projections.effective.ids,
+      mandatoryIds: projections.mandatory.ids,
+      lazyRouter: {
+        state: deferredIds.length > 0 ? "required" : "disabled",
+        deferredIds: projections.deferred.ids
+      },
+      configuredIds: projections.configured.ids,
+      droppedIds: projections.dropped.ids,
+      counts: {
+        selected: selectedIds.length,
+        effective: effectiveIds.length,
+        mandatory: mandatoryIds.length,
+        deferred: deferredIds.length,
+        configured: configuredIds.length,
+        dropped: droppedIds.length
+      },
+      idsTruncated: Object.values(projections).some((projection) => projection.truncated)
+    }
+  };
+}
+async function workspaceSessionToolPolicyServerIds(db, workspaceId, settings, subjectId) {
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
+    ...subjectId ? { subjectId } : {}
+  });
+  return sortedIds(runtimeSettings.mcpServers.map((server) => server.id));
+}
+async function workspaceSessionToolPolicyDefaultServerIds(db, workspaceId, settings, subjectId) {
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
+    ...subjectId ? { subjectId } : {}
+  });
+  const workspace = await requireWorkspace3(db, workspaceId);
+  return workspaceSessionToolPolicyDefaultServerIdsFor(
+    runtimeSettings.mcpServers,
+    workspace.settings
+  );
+}
+function workspaceSessionToolPolicyDefaultServerIdsFor(runtimeMcpServers, workspaceSettings) {
+  const availableDefaults = defaultSessionMcpServerIds(runtimeMcpServers);
+  const configured = resolveWorkspaceSessionToolDefaults(workspaceSettings);
+  if (!configured?.mcpServerIds) return availableDefaults;
+  const available = new Set(availableDefaults);
+  return sortedIds([
+    ...configured.mcpServerIds.filter((id) => available.has(id)),
+    ...configured.inheritConnectedMcpServers ? availableDefaults.filter((id) => !["opengeni", "files", "docs"].includes(id)) : []
+  ]);
+}
+function sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDefaultServerIds = []) {
+  const availableIds = new Set(workspaceServerIds);
+  for (const server of session.mcpServers) {
+    availableIds.add(server.id);
+  }
+  return {
+    ...session,
+    effectiveToolPolicy: resolveSessionToolPolicy({
+      toolPolicy: session.toolPolicy,
+      sessionTools: session.tools,
+      availableMcpServerIds: availableIds,
+      defaultMcpServerIds: workspaceDefaultServerIds
+    }).effectivePolicy
+  };
+}
+
 // src/domain/timeline-annotations.ts
 import {
   DraftTimelineAnnotations,
@@ -5760,7 +5925,7 @@ import {
   gitCredentialProviderForRepository,
   defaultRepositoryMountPath,
   mergeResourceRefs as mergeContractResourceRefs,
-  mergeToolRefs,
+  mergeToolRefs as mergeToolRefs2,
   normalizeRepositorySubpath,
   normalizeRepositoryTransportUri,
   normalizeResourceMountPath,
@@ -5800,20 +5965,20 @@ function validateToolRefs(tools, settings) {
       ...tool.eager === true ? { eager: true } : {}
     });
   }
-  return mergeToolRefs([], out);
+  return mergeToolRefs2([], out);
 }
 function enabledCapabilityMcpToolRefs(settings, runtimeSettings) {
   const configuredIds = new Set(settings.mcpServers.map((server) => server.id));
   return runtimeSettings.mcpServers.filter((server) => !configuredIds.has(server.id)).map((server) => ({ kind: "mcp", id: server.id, optional: true }));
 }
 function withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings) {
-  return mergeToolRefs(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));
+  return mergeToolRefs2(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));
 }
 function withWorkspaceDefaultMcpTools(tools, settings, runtimeSettings, defaults2) {
   if (!defaults2?.mcpServerIds) {
     return withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings);
   }
-  return mergeToolRefs(
+  return mergeToolRefs2(
     tools,
     validateToolRefs(
       [
@@ -7855,6 +8020,12 @@ function canonicalConfiguredModel(settings, model) {
     return model;
   }
   const canonicalModel = canonicalizeConfiguredModelId(settings, model);
+  if (canonicalModel.startsWith(CODEX_MODEL_ID_PREFIX) && settings.resolvedCodexModelsJson !== void 0) {
+    if (settings.codexSubscriptionEnabled && configuredAllowedModels(withCodexCatalogProvider2(settings)).includes(canonicalModel)) {
+      return canonicalModel;
+    }
+    throw new HTTPException15(422, { message: `model is not available: ${model}` });
+  }
   if (configuredAllowedModels(settings).includes(canonicalModel)) {
     return canonicalModel;
   }
@@ -8383,8 +8554,8 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
       message: `parent session not found in workspace: ${parentSessionId}`
     });
   }
-  const workspace = await requireWorkspace3(db, workspaceId);
-  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
+  const workspace = await requireWorkspace4(db, workspaceId);
+  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults2(workspace.settings);
   const parentAuthority = parentSession ? await getSessionAuthorityProjection4(db, workspaceId, parentSession.id) : null;
   if (parentSession && !parentAuthority) {
     throw new HTTPException15(403, {
@@ -9426,23 +9597,32 @@ async function acceptSessionUserMessageInFileScope(deps, grant, workspaceId, ses
       connectionDelegationSource.sessionId,
       connectionDelegationSource.turnId
     ) : null;
+    const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
+      db,
+      workspaceId,
+      settings,
+      inheritedPersonalConnectionDelegations ? {
+        personalConnectionDelegations: inheritedPersonalConnectionDelegations
+      } : { subjectId: grant.subjectId }
+    );
     const runtimeSettings = settingsWithSessionMcpServerMetadata(
-      await settingsWithEnabledCapabilityMcpServers(
-        db,
-        workspaceId,
-        settings,
-        inheritedPersonalConnectionDelegations ? {
-          personalConnectionDelegations: inheritedPersonalConnectionDelegations
-        } : { subjectId: grant.subjectId }
-      ),
+      capabilityRuntimeSettings,
       existingSession.mcpServers
     );
+    const connectionAccountTools = sessionToolsForConnectionAccounts({
+      session: existingSession,
+      runtimeMcpServers: runtimeSettings.mcpServers,
+      defaultMcpServerIds: workspaceSessionToolPolicyDefaultServerIdsFor(
+        capabilityRuntimeSettings.mcpServers,
+        (await requireWorkspace4(db, workspaceId)).settings
+      )
+    });
     const { personalConnectionDelegations, mcpAccountBindings } = await freezeConnectionAccounts({
       db,
       accountId: grant.accountId,
       workspaceId,
       settings: runtimeSettings,
-      tools: existingSession.tools,
+      tools: connectionAccountTools,
       resources: [...existingSession.resources, ...requestedResources],
       source: connectionDelegationSource,
       targetSessionId: sessionId,
@@ -9607,7 +9787,7 @@ async function updateSessionMcpApprovalPolicy(deps, grant, sessionId, serverId,
   };
 }
 function toolPolicyAuditSnapshot(session, tools, firstPartyMcpTools, policy = session.toolPolicy) {
-  const allToolRefs = mergeToolRefs([], tools).sort((left, right) => {
+  const allToolRefs = mergeToolRefs2([], tools).sort((left, right) => {
     const leftMandatory = left.kind === "mcp" && left.id === "opengeni";
     const rightMandatory = right.kind === "mcp" && right.id === "opengeni";
     if (leftMandatory !== rightMandatory) return leftMandatory ? -1 : 1;
@@ -9644,8 +9824,8 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
   requirePermission(grant, "sessions:control");
   const agentAttemptCaller = grantHasAgentAttemptAuthority(grant);
   const existingSession = await requireSession2(deps.db, grant.workspaceId, sessionId);
-  const workspace = await requireWorkspace3(deps.db, grant.workspaceId);
-  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
+  const workspace = await requireWorkspace4(deps.db, grant.workspaceId);
+  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults2(workspace.settings);
   const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
     deps.db,
     grant.workspaceId,
@@ -9930,7 +10110,15 @@ function withFirstPartyTools(tools, runtimeSettings) {
   if (!runtimeSettings.mcpServers.some((server) => server.id === "opengeni")) {
     return tools;
   }
-  return mergeToolRefs(tools, [{ kind: "mcp", id: "opengeni" }]);
+  return mergeToolRefs2(tools, [{ kind: "mcp", id: "opengeni" }]);
+}
+function sessionToolsForConnectionAccounts(input) {
+  return resolveSessionToolPolicy({
+    toolPolicy: input.session.toolPolicy,
+    sessionTools: input.session.tools,
+    availableMcpServerIds: [...input.runtimeMcpServers].map((server) => server.id),
+    defaultMcpServerIds: input.defaultMcpServerIds
+  }).toolRefs;
 }
 function hasOwnProperty(value, key) {
   return Boolean(
@@ -10629,12 +10817,13 @@ import { HTTPException as HTTPException19 } from "hono/http-exception";
 import { pinnedFetch as pinnedFetch2, readResponseJsonBounded as readResponseJsonBounded2, readResponseTextBounded } from "@opengeni/network";
 import {
   PORTABLE_SKILL_MAX_FILES as PORTABLE_SKILL_MAX_FILES2,
+  PORTABLE_SKILL_MAX_FILE_BYTES as PORTABLE_SKILL_MAX_FILE_BYTES2,
   PORTABLE_SKILL_MAX_TOTAL_BYTES as PORTABLE_SKILL_MAX_TOTAL_BYTES2
 } from "@opengeni/runtime/skill-library";
 var githubApiBase = "https://api.github.com";
 var githubRequestTimeoutMs = 15e3;
 var githubMetadataMaxBytes = 4 * 1024 * 1024;
-var githubBlobResponseMaxBytes = 512 * 1024;
+var githubBlobResponseMaxBytes = PORTABLE_SKILL_MAX_FILE_BYTES2 * 2;
 function createGitHubSkillSourceClient(settings, requestJson = (path, maxBytes, label) => githubJson(settings, path, maxBytes, label)) {
   const readJson = requestJson;
   const cache = /* @__PURE__ */ new Map();
@@ -12187,147 +12376,6 @@ function personalGitHubActionPolicyActor(input) {
   };
 }
 
-// src/domain/session-tool-policy.ts
-import {
-  SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
-  SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH,
-  mergeToolRefs as mergeToolRefs2,
-  resolveWorkspaceSessionToolDefaults as resolveWorkspaceSessionToolDefaults2
-} from "@opengeni/contracts";
-import { requireWorkspace as requireWorkspace4 } from "@opengeni/db";
-var MANDATORY_SESSION_MCP_SERVER_IDS = ["opengeni"];
-var PROJECTABLE_REGISTRY_ID = /^[A-Za-z0-9_-]+$/;
-function sortedIds(ids) {
-  return [...new Set(ids)].sort();
-}
-function defaultSessionMcpServerIds(servers) {
-  const mandatory = new Set(MANDATORY_SESSION_MCP_SERVER_IDS);
-  return sortedIds([...servers].map((server) => server.id).filter((id) => !mandatory.has(id)));
-}
-function projectIds(ids) {
-  const projectable = ids.filter(
-    (id) => id.length <= SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH && PROJECTABLE_REGISTRY_ID.test(id)
-  );
-  return {
-    ids: projectable.slice(0, SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT),
-    truncated: projectable.length !== ids.length || projectable.length > SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT
-  };
-}
-function resolveSessionToolPolicy(input) {
-  const policy = input.toolPolicy;
-  const availableIds = new Set(input.availableMcpServerIds);
-  const defaultIds = new Set(input.defaultMcpServerIds ?? []);
-  const mandatoryIds = MANDATORY_SESSION_MCP_SERVER_IDS.filter(
-    (id) => availableIds.has(id)
-  );
-  const mandatoryIdSet = new Set(mandatoryIds);
-  const tracksWorkspaceDefaults = policy.mode === "workspace_default";
-  const excludedIds = new Set(tracksWorkspaceDefaults ? policy.excludedMcpServerIds : []);
-  const selectedRefs = mergeToolRefs2([], input.sessionTools).filter(
-    (tool) => !excludedIds.has(tool.id) || mandatoryIdSet.has(tool.id)
-  );
-  let toolRefs = selectedRefs.filter((tool) => availableIds.has(tool.id));
-  if (tracksWorkspaceDefaults) {
-    toolRefs = mergeToolRefs2(
-      toolRefs,
-      sortedIds(defaultIds).filter((id) => availableIds.has(id) && !excludedIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true }))
-    );
-  }
-  toolRefs = mergeToolRefs2(
-    toolRefs,
-    mandatoryIds.map((id) => ({ kind: "mcp", id }))
-  );
-  const requestedEffectiveRefs = mergeToolRefs2(
-    selectedRefs,
-    tracksWorkspaceDefaults ? sortedIds(defaultIds).filter((id) => availableIds.has(id) && !excludedIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true })) : []
-  );
-  const effectiveIds = sortedIds(
-    mergeToolRefs2(
-      requestedEffectiveRefs,
-      mandatoryIds.map((id) => ({ kind: "mcp", id }))
-    ).map((tool) => tool.id)
-  );
-  const configuredIds = effectiveIds.filter((id) => availableIds.has(id));
-  const configuredIdSet = new Set(configuredIds);
-  const droppedIds = effectiveIds.filter((id) => !configuredIdSet.has(id));
-  const deferredIds = sortedIds(
-    toolRefs.filter((tool) => configuredIdSet.has(tool.id) && tool.eager !== true).map((tool) => tool.id)
-  );
-  const selectedIds = sortedIds(
-    selectedRefs.filter(
-      (tool) => !mandatoryIdSet.has(tool.id) && !(tracksWorkspaceDefaults && tool.optional === true)
-    ).map((tool) => tool.id)
-  );
-  const projections = {
-    selected: projectIds(selectedIds),
-    effective: projectIds(effectiveIds),
-    mandatory: projectIds(sortedIds(mandatoryIds)),
-    deferred: projectIds(deferredIds),
-    configured: projectIds(configuredIds),
-    dropped: projectIds(droppedIds)
-  };
-  return {
-    toolRefs,
-    effectivePolicy: {
-      mode: policy.mode,
-      inheritedFromSessionId: policy.inheritedFromSessionId,
-      selectedIds: projections.selected.ids,
-      effectiveIds: projections.effective.ids,
-      mandatoryIds: projections.mandatory.ids,
-      lazyRouter: {
-        state: deferredIds.length > 0 ? "required" : "disabled",
-        deferredIds: projections.deferred.ids
-      },
-      configuredIds: projections.configured.ids,
-      droppedIds: projections.dropped.ids,
-      counts: {
-        selected: selectedIds.length,
-        effective: effectiveIds.length,
-        mandatory: mandatoryIds.length,
-        deferred: deferredIds.length,
-        configured: configuredIds.length,
-        dropped: droppedIds.length
-      },
-      idsTruncated: Object.values(projections).some((projection) => projection.truncated)
-    }
-  };
-}
-async function workspaceSessionToolPolicyServerIds(db, workspaceId, settings, subjectId) {
-  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
-    ...subjectId ? { subjectId } : {}
-  });
-  return sortedIds(runtimeSettings.mcpServers.map((server) => server.id));
-}
-async function workspaceSessionToolPolicyDefaultServerIds(db, workspaceId, settings, subjectId) {
-  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
-    ...subjectId ? { subjectId } : {}
-  });
-  const availableDefaults = defaultSessionMcpServerIds(runtimeSettings.mcpServers);
-  const workspace = await requireWorkspace4(db, workspaceId);
-  const configured = resolveWorkspaceSessionToolDefaults2(workspace.settings);
-  if (!configured?.mcpServerIds) return availableDefaults;
-  const available = new Set(availableDefaults);
-  return sortedIds([
-    ...configured.mcpServerIds.filter((id) => available.has(id)),
-    ...configured.inheritConnectedMcpServers ? availableDefaults.filter((id) => !["opengeni", "files", "docs"].includes(id)) : []
-  ]);
-}
-function sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDefaultServerIds = []) {
-  const availableIds = new Set(workspaceServerIds);
-  for (const server of session.mcpServers) {
-    availableIds.add(server.id);
-  }
-  return {
-    ...session,
-    effectiveToolPolicy: resolveSessionToolPolicy({
-      toolPolicy: session.toolPolicy,
-      sessionTools: session.tools,
-      availableMcpServerIds: availableIds,
-      defaultMcpServerIds: workspaceDefaultServerIds
-    }).effectivePolicy
-  };
-}
-
 // src/domain/scheduled-tasks.ts
 import {
   scheduledTaskKnowledgeSource,
@@ -15932,6 +15980,7 @@ import {
   publicNewSessionDraftOptions,
   requireFileForSubject as requireFileForSubject2,
   saveNewSessionDraftInTransaction,
+  reusableNewSessionRepositoryResource,
   withWorkspaceSubjectRls as withWorkspaceSubjectRls6
 } from "@opengeni/db";
 import { HTTPException as HTTPException23 } from "hono/http-exception";
@@ -16153,6 +16202,31 @@ async function saveActorNewSessionDraft(...args) {
   const actor = authorization ? await fileOwnerContextForAccess(deps, authorization, "sessions:create") : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
   return withSessionRlsActorContext6(actor, () => saveActorNewSessionDraftInFileScope(...args));
 }
+async function getActorNewSessionDefaults(deps, grant, workspaceId) {
+  const draft = await getActorNewSessionDraft(deps, grant, workspaceId);
+  const options = draft.options;
+  return {
+    // Revision zero is a synthetic empty form, not a user's model preference.
+    ...draft.revision > 0 ? {
+      model: draft.model,
+      reasoningEffort: draft.reasoningEffort,
+      latencyMode: draft.latencyMode
+    } : {},
+    resources: draft.resources.flatMap(
+      (resource) => resource.kind === "repository" ? [reusableNewSessionRepositoryResource(resource)] : []
+    ),
+    ...draft.toolsProvided ? { tools: draft.tools } : options.excludedMcpServerIds ? { excludedMcpServerIds: options.excludedMcpServerIds } : {},
+    ...options.firstPartyMcpTools ? { firstPartyMcpTools: options.firstPartyMcpTools } : {},
+    ...options.firstPartyMcpPermissions ? { firstPartyMcpPermissions: options.firstPartyMcpPermissions } : {},
+    ...options.variableSetIds ? { variableSetIds: options.variableSetIds } : {},
+    ...options.rigId ? { rigId: options.rigId } : {},
+    ...options.sandboxBackend ? { sandboxBackend: options.sandboxBackend } : {},
+    ...options.targetSandboxId ? {
+      targetSandboxId: options.targetSandboxId,
+      ...options.workingDir ? { workingDir: options.workingDir } : {}
+    } : {}
+  };
+}
 
 // src/application/composer-submit.ts
 async function submitComposerDraftForRequest(deps, grant, workspaceId, sessionId, input, options = {}) {
@@ -17907,6 +17981,7 @@ export {
   freezeAgentChildAutomaticTitleInCreatorContext,
   freezeConnectionAccounts,
   freezePersonalConnectionDelegations,
+  getActorNewSessionDefaults,
   getActorNewSessionDraft,
   getAutomationAdapter,
   getConnectorToolPermissions,
@@ -17977,7 +18052,7 @@ export {
   mergeCausalFrontiers,
   mergeResourceRefs,
   mergeRigDefaultVariableSetEnvironment,
-  mergeToolRefs,
+  mergeToolRefs2 as mergeToolRefs,
   modelFundingForAdmission,
   moveHumanQueuePrompt,
   nativeConnectionCapabilityRecommendations,
@@ -18128,9 +18203,11 @@ export {
   searchKnowledgeEntries,
   selectedPersonalConnectionServers,
   sendAgentSessionMessage,
+  sessionGroupMachinePresentation,
   sessionMcpRotationFingerprint,
   sessionRlsActorForAuthorization,
   sessionSpawnDenialEnvelope,
+  sessionToolsForConnectionAccounts,
   sessionWithEffectiveToolPolicy,
   settingsWithApiIntegrationServers,
   settingsWithCodexAppsMcpServer,
@@ -18196,6 +18273,7 @@ export {
   workspaceCustomModelReference,
   workspaceInsightsPhaseMetricObserver,
   workspaceSessionToolPolicyDefaultServerIds,
+  workspaceSessionToolPolicyDefaultServerIdsFor,
   workspaceSessionToolPolicyServerIds,
   wrapChannelABoxWithRouting
 };