@opengeni/runtime 3.2.2 → 3.4.0

package/src/browser-model-text.ts

@@ -0,0 +1,378 @@
+/**
+ * The model's text view of browser tool results.
+ *
+ * A browser tool result keeps its complete typed value in `structuredContent`
+ * for Code Mode, the API and the UI. What the model reads is this text: an
+ * outline with one line per page element, in the role/name vocabulary that
+ * locators use. It repeats no envelope keys, quoting or bookkeeping ids the
+ * model never sends back, which makes a page view about half the tokens of
+ * the same value as JSON.
+ */
+
+export type BrowserTextNode = {
+  ref: string;
+  role: string;
+  depth: number;
+  name?: string | undefined;
+  description?: string | undefined;
+  value?: string | { redacted: true; reason: string } | undefined;
+  states?: readonly string[] | undefined;
+  actions?: readonly string[] | undefined;
+};
+
+export type BrowserTextTarget = {
+  id: string;
+  kind: string;
+  title: string;
+  url: string;
+  selected?: boolean | undefined;
+};
+
+export type BrowserTextObservation = {
+  target: BrowserTextTarget;
+  viewport?:
+    | {
+        width: number;
+        height: number;
+        deviceScaleFactor?: number | undefined;
+        maxTouchPoints?: number | undefined;
+      }
+    | null
+    | undefined;
+  focusedRef?: string | null | undefined;
+  changedRegions?: readonly unknown[] | undefined;
+  diagnostics?:
+    | {
+        consoleErrorCount: number;
+        failedRequestCount: number;
+        downloadCount: number;
+        pageErrorCount: number;
+      }
+    | null
+    | undefined;
+  dialog?: { type: string; message: string; defaultPrompt?: string | undefined } | null | undefined;
+  screenshot?: unknown;
+  agentView: {
+    sourceKind: string;
+    nodes: readonly BrowserTextNode[];
+    omittedNodeCount?: number | undefined;
+    removedRefCount?: number | undefined;
+    clippedFieldCount?: number | undefined;
+  };
+};
+
+/** Text, structure and table-layout roles. Locate these by text or role and
+ * name; listing their refs would cost every page view several tokens per line
+ * for nodes that are almost never acted on. A complete view, a focused read,
+ * and any node that reports actions still show every ref. */
+const REFLESS_ROLES: ReadonlySet<string> = new Set([
+  "article",
+  "banner",
+  "blockquote",
+  "caption",
+  "cell",
+  "code",
+  "columnheader",
+  "complementary",
+  "contentinfo",
+  "definition",
+  "deletion",
+  "document",
+  "emphasis",
+  "figure",
+  "form",
+  "generic",
+  "group",
+  "heading",
+  "insertion",
+  "LabelText",
+  "LineBreak",
+  "list",
+  "listitem",
+  "log",
+  "main",
+  "mark",
+  "navigation",
+  "none",
+  "note",
+  "paragraph",
+  "presentation",
+  "region",
+  "row",
+  "rowgroup",
+  "rowheader",
+  "Section",
+  "separator",
+  "status",
+  "strong",
+  "subscript",
+  "superscript",
+  "table",
+  "term",
+  "text",
+  "time",
+]);
+
+/** States every page repeats that tell the model nothing it can act on. */
+function shownState(role: string, state: string): boolean {
+  if (state === "focusable" || state === "settable" || state === "editable") return false;
+  if (state.startsWith("editable=") || state.startsWith("url=")) return false;
+  if (state.endsWith("=")) return false;
+  if (role === "document" && state === "focused") return false;
+  return true;
+}
+
+function quoted(value: string): string {
+  return JSON.stringify(value);
+}
+
+export function browserNodeLine(node: BrowserTextNode, allRefs: boolean, baseDepth = 0): string {
+  const parts = [`${"  ".repeat(Math.max(0, node.depth - baseDepth))}- ${node.role}`];
+  if (node.name) parts.push(quoted(node.name));
+  if (allRefs || (node.actions?.length ?? 0) > 0 || !REFLESS_ROLES.has(node.role)) {
+    parts.push(`[${node.ref}]`);
+  }
+  if (node.value !== undefined && node.value !== "") {
+    parts.push(typeof node.value === "string" ? `value=${quoted(node.value)}` : "value=<redacted>");
+  }
+  if (node.description) parts.push(`description=${quoted(node.description)}`);
+  for (const state of node.states ?? []) if (shownState(node.role, state)) parts.push(state);
+  return parts.join(" ");
+}
+
+export function browserTargetLine(target: BrowserTextTarget): string {
+  const kind = target.kind === "page" ? "" : ` (${target.kind})`;
+  const selected = target.selected ? " selected" : "";
+  return `Tab ${target.id}${kind}${selected}: ${quoted(target.title)} ${target.url}`;
+}
+
+/** Indent relative to the shallowest listed node, so a view of a deeply
+ * nested part of the page does not spend tokens on leading spaces. */
+function shallowestDepth(nodes: readonly BrowserTextNode[]): number {
+  let base = Number.POSITIVE_INFINITY;
+  for (const node of nodes) base = Math.min(base, node.depth);
+  return Number.isFinite(base) ? base : 0;
+}
+
+function plural(count: number, noun: string): string {
+  if (count === 1) return `${count} ${noun}`;
+  return `${count} ${noun}${/(?:s|x|ch|sh)$/.test(noun) ? "es" : "s"}`;
+}
+
+export function browserObservationText(
+  observation: BrowserTextObservation,
+  options: { allRefs?: boolean } = {},
+): string {
+  const allRefs = options.allRefs === true;
+  const lines = [browserTargetLine({ ...observation.target, selected: false })];
+  const viewport = observation.viewport;
+  if (viewport) {
+    const extras = [
+      viewport.deviceScaleFactor && viewport.deviceScaleFactor !== 1
+        ? `scale ${viewport.deviceScaleFactor}`
+        : null,
+      viewport.maxTouchPoints ? `${viewport.maxTouchPoints} touch points` : null,
+    ].filter((entry): entry is string => entry !== null);
+    lines.push(
+      `Viewport ${viewport.width}x${viewport.height}${extras.length ? ` (${extras.join(", ")})` : ""}`,
+    );
+  }
+  const dialog = observation.dialog;
+  if (dialog) {
+    const prompt =
+      dialog.type === "prompt" && dialog.defaultPrompt
+        ? ` default ${quoted(dialog.defaultPrompt)}`
+        : "";
+    lines.push(`Open ${dialog.type} dialog: ${quoted(dialog.message)}${prompt}`);
+  }
+  const diagnostics = observation.diagnostics;
+  if (diagnostics) {
+    const reported = [
+      diagnostics.consoleErrorCount ? plural(diagnostics.consoleErrorCount, "console error") : null,
+      diagnostics.pageErrorCount ? plural(diagnostics.pageErrorCount, "page error") : null,
+      diagnostics.failedRequestCount
+        ? plural(diagnostics.failedRequestCount, "failed request")
+        : null,
+      diagnostics.downloadCount ? plural(diagnostics.downloadCount, "download") : null,
+    ].filter((entry): entry is string => entry !== null);
+    if (reported.length) lines.push(`Page reported ${reported.join(", ")}`);
+  }
+  if (observation.changedRegions && observation.changedRegions.length > 0) {
+    lines.push(`Changed regions: ${JSON.stringify(observation.changedRegions)}`);
+  }
+  if (observation.screenshot) lines.push(`Screenshot: ${JSON.stringify(observation.screenshot)}`);
+  const view = observation.agentView;
+  const nodes = view.nodes;
+  if (
+    observation.focusedRef &&
+    !nodes.some(
+      (node) => node.ref === observation.focusedRef && (node.states ?? []).includes("focused"),
+    )
+  ) {
+    lines.push(`Focused element: ${observation.focusedRef}`);
+  }
+  if (view.sourceKind === "none") {
+    lines.push("No accessibility view is available for this tab.");
+  } else {
+    if (view.sourceKind === "diff") lines.push("Changed elements:");
+    const base = shallowestDepth(nodes);
+    for (const node of nodes) lines.push(browserNodeLine(node, allRefs, base));
+  }
+  const notes = [
+    view.omittedNodeCount ? `${plural(view.omittedNodeCount, "element")} not shown` : null,
+    view.removedRefCount ? `${plural(view.removedRefCount, "earlier element")} removed` : null,
+    view.clippedFieldCount ? `${plural(view.clippedFieldCount, "long field")} clipped` : null,
+  ].filter((entry): entry is string => entry !== null);
+  if (notes.length) lines.push(`(${notes.join("; ")})`);
+  return lines.join("\n");
+}
+
+export type BrowserTextResolvedTarget = {
+  actionIndex: number;
+  ref: string | null;
+  role: string;
+  name: string | null;
+  container: { role: string; name: string | null } | null;
+};
+
+function resolvedTargetText(target: BrowserTextResolvedTarget): string {
+  const parts = [`#${target.actionIndex} ${target.role}`];
+  if (target.name) parts.push(quoted(target.name));
+  if (target.ref) parts.push(`[${target.ref}]`);
+  if (target.container) {
+    parts.push(
+      `in ${target.container.role}${target.container.name ? ` ${quoted(target.container.name)}` : ""}`,
+    );
+  }
+  return parts.join(" ");
+}
+
+export function browserActionText(receipt: {
+  targetId: string;
+  state: string;
+  error?:
+    | ({ code: string; message: string; retryable: boolean } & Record<string, unknown>)
+    | null
+    | undefined;
+  targets?: readonly BrowserTextResolvedTarget[] | undefined;
+  observation?: BrowserTextObservation | null | undefined;
+  allRefs?: boolean | undefined;
+}): string {
+  const lines = [`Action ${receipt.state} on tab ${receipt.targetId}.`];
+  if (receipt.error) {
+    const { code, message, retryable, ...details } = receipt.error;
+    lines.push(
+      `Error ${code}${retryable ? " (retryable)" : ""}: ${message}${
+        Object.keys(details).length ? ` ${JSON.stringify(details)}` : ""
+      }`,
+    );
+  }
+  if (receipt.targets && receipt.targets.length > 0) {
+    lines.push(`Acted on: ${receipt.targets.map(resolvedTargetText).join("; ")}`);
+  }
+  if (receipt.observation) {
+    lines.push(browserObservationText(receipt.observation, { allRefs: receipt.allRefs === true }));
+  }
+  return lines.join("\n");
+}
+
+const PLACEMENT_LABELS: Record<string, string> = {
+  sandbox_group: "the managed sandbox",
+  connected_machine: "a Connected Machine",
+  external_provider: "a remote browser provider",
+  attached_device: "the user's own Chrome",
+};
+
+export function browserSessionLine(session: {
+  id: string;
+  lifecycle: string;
+  placement: { kind: string };
+  engine?: string | null | undefined;
+  headless?: boolean | null | undefined;
+  identityId?: string | null | undefined;
+  failureCode?: string | null | undefined;
+}): string {
+  const engine = session.engine ?? "browser";
+  const mode =
+    session.placement.kind === "attached_device" ? "" : session.headless ? " headless" : " headed";
+  const placement = PLACEMENT_LABELS[session.placement.kind] ?? session.placement.kind;
+  const extras = [
+    session.identityId ? `identity ${session.identityId}` : null,
+    session.failureCode ? `failure ${session.failureCode}` : null,
+  ].filter((entry): entry is string => entry !== null);
+  return `BrowserSession ${session.id} (${session.lifecycle}): ${engine}${mode} on ${placement}${
+    extras.length ? `, ${extras.join(", ")}` : ""
+  }`;
+}
+
+type AttachedProfileText = { id: string; name: string; profileLabel?: string | undefined };
+
+function attachedProfileText(profile: AttachedProfileText): string {
+  return `${quoted(profile.name)}${profile.profileLabel ? ` (${profile.profileLabel})` : ""} deviceId ${profile.id}`;
+}
+
+export function browserOpenText(output: {
+  session: Parameters<typeof browserSessionLine>[0];
+  targets: readonly BrowserTextTarget[];
+  otherTabCount?: number | undefined;
+  observation?: BrowserTextObservation | undefined;
+  attachedProfile?: AttachedProfileText | undefined;
+  otherAttachedProfiles?: readonly AttachedProfileText[] | undefined;
+}): string {
+  const lines = [browserSessionLine(output.session)];
+  if (output.attachedProfile) {
+    lines.push(`Attached Chrome profile: ${attachedProfileText(output.attachedProfile)}`);
+  }
+  if (output.otherAttachedProfiles && output.otherAttachedProfiles.length > 0) {
+    lines.push(
+      `Other attached profiles: ${output.otherAttachedProfiles.map(attachedProfileText).join("; ")}`,
+    );
+  }
+  const observedId = output.observation?.target.id;
+  for (const target of output.targets) {
+    if (target.id !== observedId) lines.push(browserTargetLine(target));
+  }
+  if (output.otherTabCount) {
+    lines.push(`${plural(output.otherTabCount, "other tab")} (browser_tabs list shows them)`);
+  }
+  if (output.observation) lines.push(browserObservationText(output.observation));
+  else if (output.targets.length === 0) lines.push("No tabs are open.");
+  return lines.join("\n");
+}
+
+export function browserTabsText(output: {
+  browserSessionId: string;
+  targets: readonly BrowserTextTarget[];
+  mutationObservation?: BrowserTextObservation | undefined;
+}): string {
+  const lines = [
+    `BrowserSession ${output.browserSessionId} has ${plural(output.targets.length, "tab")}:`,
+  ];
+  for (const target of output.targets) lines.push(browserTargetLine(target));
+  if (output.mutationObservation) lines.push(browserObservationText(output.mutationObservation));
+  return lines.join("\n");
+}
+
+export function browserReadText(output: {
+  targetId: string;
+  mode: string;
+  scopeFound: boolean;
+  nodes: readonly BrowserTextNode[];
+  totalMatches: number;
+  omittedMatches: number;
+  clippedFieldCount: number;
+}): string {
+  const lines = [
+    `Tab ${output.targetId}: ${plural(output.totalMatches, "match")} (${output.mode})${
+      output.scopeFound ? "" : "; the scope element was not found"
+    }`,
+  ];
+  const base = shallowestDepth(output.nodes);
+  for (const node of output.nodes) lines.push(browserNodeLine(node, true, base));
+  const notes = [
+    output.omittedMatches ? `${plural(output.omittedMatches, "match")} not shown` : null,
+    output.clippedFieldCount ? `${plural(output.clippedFieldCount, "long field")} clipped` : null,
+  ].filter((entry): entry is string => entry !== null);
+  if (notes.length) lines.push(`(${notes.join("; ")})`);
+  return lines.join("\n");
+}

package/src/bundled_site_skills/opengeni-sites/SKILL.md

@@ -18,8 +18,9 @@ Site on the web is built in (see "Publish to the web").
 
 A Site never needs its own server, API key, or hosting provider to reach
 Opengeni. Model access, agent conversations, and workspace tools all come from
-the host bridge: `createOpenGeniSiteClient` from `@opengeni/sdk/site` plus the
-`@opengeni/react/session-ui` conversation surface. The parent page owns the
+the host bridge: `createOpenGeniSiteClient` from `@opengeni/sdk/site`. Use its
+`ai.run` helper for inline results, or `@opengeni/react/session-ui` when the app
+needs a conversation surface. The parent page owns the
 credentials and workspace identity; Site code receives neither, so "keep
 credentials server-side" is already satisfied by that bridge.
 
@@ -239,6 +240,33 @@ const client = createOpenGeniSiteClient();
 const issues = await client.tools.linear.issues_list({ state: "Todo" });
 ```
 
+### Inline AI: the app chooses the interaction
+
+Use `site.ai.run({ initialMessage: appDefinedPrompt, idempotencyKey: actionId })`
+to return AI output inside the app without mounting chat or displaying history.
+Prompts, context, controls and results are app-designed; Draft, Summarize or
+Classify are merely possible examples, never required buttons or templates.
+Use `onText` for incremental text and `onSession` to retain a native handle before
+waiting. A result has `text`, `sessionId`, `turnId`, `after` and `status`:
+`completed`, `pending` (approval/input needed), or `cancelled`; failures reject.
+Validate any app-defined structured output before using it.
+
+This is ordinary native execution with the same model access, subscriptions,
+permissions, tool selection, approvals, metering and outsider caps. Aborting the
+observation does not cancel the task. `site.ai.result(id, { turnId })` replays
+without creating more work. Supplying `after` returns subsequent text only;
+retain earlier text or omit it for a full replay. Keep retry keys stable per
+action and handles in viewer-private state/storage, not shared Site Data.
+
+Site AI is private per viewer by default and does not clutter the workspace
+sidebar or ordinary search. Signed-in members use their real human identity;
+guests use existing cookie/visitor continuity, not a shared anonymous chat.
+If organization policy disallows private execution, surface its explicit
+refusal; never fall back to shared sessions. Privacy does not automatically
+extend to separately published artifacts or shared Site Data.
+
+### Optional conversation UI
+
 For embedded conversations, `site.client` is the ordinary Opengeni SDK client;
 `site.workspaceId` is a host-resolved routing alias. Use the normal React
 complete conversation surface—do not implement session REST or SSE yourself:
@@ -259,7 +287,7 @@ const site = createOpenGeniSiteClient();
 ```
 
 `sessionId` is the existing session or the id returned by `site.client.createSession`.
-For a normal chat app, offer a conversation selector and “New conversation”.
+For a normal chat app, a conversation selector and “New conversation” are optional.
 Create on first Send rather than mounting the page; keep the selected id in React
 state and reopen existing conversations through the SDK.
 Keep first-send creation single-flight; reuse its `idempotencyKey` when retrying,
@@ -272,14 +300,17 @@ write origin metadata yourself. The local preview has no published identity, so
 this filter returns no Site history there; test newly created/current conversations
 locally and the selector after publication.
 
-This is a default, not a restriction. For a project-focused app, use `channelId`
-on SDK creation/listing instead; its list may include conversations created
-elsewhere. Project management tools use `projectId` (see `opengeni-projects`
-when available). Do not automatically create a project just to group Site chats.
-Unfiled Site conversations group under their Site in the main sidebar; explicit
-projects and pins take precedence. Origin remains visible regardless of placement.
-The host Site page always provides its own Conversations panel independently of
-the navigation you build. Opening existing sessions never changes their origin.
+Do not automatically create a project just to group Site chats. Site execution
+does not appear in ordinary workspace discovery, even for its owner. The host
+Site page provides a viewer-scoped Conversations panel independently of app
+navigation. Opening existing sessions never changes their origin or audience.
+Page code cannot widen the Site boundary by supplying project, visibility,
+tools or credential fields; use ordinary authoring tools for project management.
+
+Per-Site AI costs are in Insights: actual credit charges are distinct from
+API-equivalent subscription/own-key estimates and unbilled platform counters.
+Usage is for limits. Do not build private transcript or viewer analytics into
+shared dashboards just because aggregate costs are visible there.
 
 `SessionConversation` connects timeline/history, durable composer drafts,
 queue display/edit/delete/steer, pause/resume, and human-input forms. Prefer it
@@ -667,8 +698,11 @@ workspace first.
   `rate_limited`, `site_budget_exhausted` and retryable `site_budget_busy` (429), and
   `site_platform_brake_engaged` (503) as normal UI states.
 - The same Site HTML and Site Data work there; no rebuild is needed.
-- Every published-host agent gets this Site's `site_data_query` and `site_data_write`,
+- Published-host agents get this Site's `site_data_query` and `site_data_write`,
   plus `site_sql_run` when SQL is enabled; members also get read-only `site_sql_query`.
+  Member tools are intersected with live permissions: a member without artifact
+  publishing can still use AI without write tools, and without data-read permission
+  can use plain AI without data tools. Never request extra permission just to chat.
   The server pins the Site and binds calls to the conversation's viewer, including
   collection ownership and query audiences. No management tools or sandbox are
   supplied; publication settings have no sandbox opt-in. Members get no Site

package/src/codex-tool-search.ts

@@ -135,6 +135,59 @@ function familyCompanions<T extends Tool & { name: string }>(disclosed: T[], poo
   return companions;
 }
 
+/**
+ * The tool that starts each interaction family. It stays in the first request,
+ * so a browser or computer task begins with its first real call instead of a
+ * search round trip, and opening discloses the rest of the family right after
+ * the open result (see the lazy-tool transport). Only a tool the attempt
+ * actually prepared can be visible: a first-party interaction tool, or one the
+ * `interaction` server listed, never a same-named tool from another server.
+ */
+const INTERACTION_ENTRY_TOOLS: ReadonlySet<string> = new Set(["browser_open", "computer_open"]);
+
+/** True when a prepared function tool is an interaction family's entry tool. */
+export function isInteractionEntryFunctionTool(
+  tool: unknown,
+  mcpServerIds: ReadonlySet<string> = NO_MCP_SERVER_IDS,
+  modelServerIds?: ReadonlyMap<string, string>,
+): boolean {
+  if (!tool || typeof tool !== "object" || (tool as { type?: unknown }).type !== "function") {
+    return false;
+  }
+  const name = (tool as { name?: unknown }).name;
+  if (typeof name !== "string" || !isInteractionEntryToolName(name)) return false;
+  const serverId = mcpServerIdForTool(tool, mcpServerIds, modelServerIds);
+  return serverId === null || serverId === INTERACTION_MCP_SERVER_ID;
+}
+
+/** True when a model tool name is an interaction family's entry tool. */
+export function isInteractionEntryToolName(name: string): boolean {
+  const short = interactionToolName(name);
+  return short !== null && INTERACTION_ENTRY_TOOLS.has(short);
+}
+
+/**
+ * The companions an entry tool discloses once it is called: the rest of its
+ * family that is still searchable, within the same byte budgets as a search.
+ */
+export function interactionEntryCompanions(entryName: string, searchable: Tool[]): Tool[] {
+  if (!isInteractionEntryToolName(entryName)) return [];
+  const pool = searchable.filter(
+    (tool): tool is Tool & { name: string } =>
+      tool.type === "function" && typeof (tool as { name?: unknown }).name === "string",
+  );
+  const disclosed: Tool[] = [];
+  let disclosedBytes = 0;
+  for (const tool of familyCompanions([{ name: entryName } as Tool & { name: string }], pool)) {
+    const toolBytes = mcpSerializedSizeBytes(tool);
+    if (toolBytes > MCP_MAX_TOOL_DEFINITION_BYTES) continue;
+    if (disclosedBytes + toolBytes > MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES) continue;
+    disclosedBytes += toolBytes;
+    disclosed.push(tool);
+  }
+  return disclosed;
+}
+
 /**
  * True when a prepared MCP function tool is one of the harness control tools
  * served by the authorized first-party `opengeni` server. These stay in the

package/src/index.ts

@@ -117,6 +117,7 @@ import { createSecretArgumentResolver } from "./secret-argument-resolution";
 import {
   approvalIdentifier,
   INTERACTION_REQUEST_HUMAN_MODEL_TOOL_NAME,
+  RequestHumanInteractionToolInput,
   CAPABILITY_DESCRIPTORS,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
   DEFAULT_FIRST_PARTY_MCP_TOOLS,
@@ -303,6 +304,7 @@ import {
   applyDiff,
   RunContext,
   ToolGuardrailFunctionOutputFactory,
+  defineToolInputGuardrail,
   type AgentInputItem,
   type CallModelInputFilter,
   type MCPServer,
@@ -3881,6 +3883,23 @@ function activeModelToolInvocation(modelName: string): ModelToolInvocation | nul
   return invocation?.modelName === modelName ? invocation : null;
 }
 
+/** Why interaction_request_human arguments cannot be recorded as an
+ * intervention, in words the model can act on, or null when they can. */
+export function interactionRequestArgumentsProblem(serialized: string): string | null {
+  let value: unknown;
+  try {
+    value = JSON.parse(serialized);
+  } catch {
+    return "Invalid interaction_request_human arguments: they are not valid JSON. Nothing was requested; call it again with a JSON object matching its schema.";
+  }
+  const parsed = RequestHumanInteractionToolInput.safeParse(value);
+  if (parsed.success) return null;
+  const issues = parsed.error.issues
+    .slice(0, 5)
+    .map((issue) => `${issue.path.join(".") || "arguments"}: ${issue.message}`);
+  return `Invalid interaction_request_human arguments: ${issues.join("; ")}. Nothing was requested; call it again with corrected arguments.`;
+}
+
 /**
  * Turn the canonical interaction-request tool into a typed SDK interruption.
  * Its MCP/Codemode catalog entry and execution stay unchanged; this projection
@@ -3903,6 +3922,22 @@ function installInteractionInterventionPolicy(
       const originalInvoke = tool.invoke.bind(tool);
       return {
         ...tool,
+        // Runs before the approval pause, so invalid arguments come back to
+        // the model as a correctable tool result. Without it the call would
+        // pause first, the intervention could never be recorded, and the
+        // turn would fail.
+        inputGuardrails: [
+          ...(tool.inputGuardrails ?? []),
+          defineToolInputGuardrail({
+            name: "validate_interaction_request_human",
+            run: async ({ toolCall }) => {
+              const problem = interactionRequestArgumentsProblem(toolCall.arguments);
+              return problem
+                ? ToolGuardrailFunctionOutputFactory.rejectContent(problem)
+                : ToolGuardrailFunctionOutputFactory.allow();
+            },
+          }),
+        ],
         needsApproval: async (
           _runContext: Parameters<typeof originalNeedsApproval>[0],
           _parsedInput: Parameters<typeof originalNeedsApproval>[1],
@@ -8469,7 +8504,10 @@ export class PrefixedMcpServer implements MCPServer {
           return {
             ...tool,
             name,
-            ...(this.accountLabel
+            // Name the account only when the turn has several accounts of this
+            // connector to tell apart. With one account the line adds nothing
+            // the model can act on, and it would repeat on every tool.
+            ...(this.accountLabel?.account
               ? {
                   description:
                     `Account: ${this.accountLabel.model}. Use only this account; if the intended account for a write is unclear, ask before calling.\n${tool.description ?? ""}`.trimEnd(),