@opengeni/worker-bundle 1.0.0-canary.1 → 1.0.0

package/src/activities/agent-turn/tool-environment.ts

@@ -1,6 +1,7 @@
 import { createKnowledgeSourceAttemptTools } from "./knowledge-source-tools";
-import { getWorkspaceConnectionModelRestrictions } from "@opengeni/db";
 import {
+  resolveInitiatingHuman,
+  buildSlackApiRateLimiter,
   beginConnectorActionExecution,
   getExternalLinkTurnAuthorization,
   getSessionTurnForAttempt,
@@ -8,29 +9,25 @@ import {
   listSkillDescriptors,
   completeConnectorActionExecution,
   getScheduledVariableSetExpectedGenerationForAttempt,
-  getWorkspaceModelPolicy,
-  listWorkspaceGatewayCustomModels,
-  listWorkspaceOpenRouterCustomModels,
-  listOrganizationModelProviderCustomModelsForWorkspace,
-  organizationModelProviderConnectionActiveForWorkspace,
   persistAttemptToolCatalog,
   prepareConnectorActionApproval,
+  recordUsageEvent,
   previewConnectorActionApproval,
   namedSubjectHasLiveWorkspaceAuthority,
   updateSessionTitleWithEvent,
   withCodexAppsRequestAuthorization,
-  workspaceCodexSubscriptionActive,
-  workspaceVercelAiGatewayConnectionActive,
-  workspaceOpenRouterConnectionActive,
-  workspaceXaiSubscriptionActiveForAuthority,
 } from "@opengeni/db";
 import { publishDurableSessionEvents } from "@opengeni/events";
 import {
   type OpenGeniRuntime,
+  type RunMcpCredentials,
+  selectedSessionRemoteMcpTargets,
   type AttemptConnectorActionBinding,
   type ConnectorAttachmentMaterializationRequest,
   type ConnectorActionPolicyHooks,
   createFirstPartyInteractionAttemptToolDefinitions,
+  mcpToolDisplayMetadata,
+  toolFamilyForCatalogIdentity,
 } from "@opengeni/runtime";
 import {
   createGoogleDrivePublicationAttemptTool,
@@ -38,6 +35,11 @@ import {
   resolveGoogleDrivePublicationTarget,
 } from "../google-drive-publication";
 import { connectionTokenResolverForTurn } from "../mcp-credentials";
+import {
+  accountRouteAuthNeededPayload,
+  expandApiIntegrationAccountRoutes,
+  expandMcpAccountRoutes,
+} from "../mcp-account-routes";
 import { createMcpOperationPersistence } from "@opengeni/db/mcp-operations";
 import { createMcpOperationReadStore } from "../mcp-operation-store";
 import { createMcpOperationObserverResolver } from "../mcp-operation-observer";
@@ -45,40 +47,49 @@ import { readMcpOperation } from "../mcp-operation-reader";
 import { createOperationReadAttemptToolDefinition } from "./mcp-operation-read-tool";
 import { buildGitHubRestMcpForTurn } from "../../github-rest-mcp";
 import { materializeConnectorAttachmentsInChannel } from "../connector-attachments";
+import { materializeGmailFile, readGmailFileFromChannel } from "../gmail-files";
+import { objectStorageForSandboxDownloads } from "./file-resources";
 import { allowedFirstPartyMcpToolsForSession, type Settings } from "@opengeni/config";
 import { CodemodeAttemptDispatcher } from "../codemode-dispatcher";
 import { buildCodexTokenResolver } from "../codex-auth";
 import { CODEX_CLIENT_VERSION } from "@opengeni/codex";
 import { mergeResourceRefs } from "../common";
 import {
-  defaultSessionMcpServerIds,
+  workspaceSessionToolPolicyDefaultServerIds,
   loadRigDefaultVariableSetEnvironment,
   mergeRigDefaultVariableSetEnvironment,
   buildApiIntegrationMcpServers,
   resolveCatalogSettings,
   resolveWorkspaceModelSelection,
+  loadWorkspaceModelSelectionInput,
   withFrozenPersonalConnectionDelegations,
-  resolveSessionToolPolicy,
+  resolveTurnToolPolicy,
+  scheduledTurnMcpServerIds,
   hasPermission,
+  requireExplicitPermissionDelegation,
 } from "@opengeni/core";
 import { loadWorkspaceEnvironmentForRunWithCredentials } from "../environment";
 import { withFirstPartyTools } from "../goals";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput } from "../types";
-import { recordTurnStartupPhase } from "../../observability-metrics";
+import {
+  recordSkillCheckout,
+  recordSkillRead,
+  recordToolPreparationPhase,
+  recordTurnStartupPhase,
+} from "../../observability-metrics";
 import { ToolResultSpill } from "./tool-result-spill";
 import { createTurnMediaArtifacts } from "./media-artifacts";
 import { SandboxChannelAService } from "@opengeni/runtime/sandbox";
 import { sandboxRunAs } from "@opengeni/runtime";
 import {
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  resolveAgentToolFamilies,
+  type ResourceRef,
+  type Permission,
   type ToolAuthNeededPayload,
 } from "@opengeni/contracts";
 
-import {
-  rollingSafeToolAuthNeededPayload,
-  shouldPublishToolAuthNeededForTurn,
-  xaiCatalogReadinessAuthority,
-} from "./admission";
+import { rollingSafeToolAuthNeededPayload, shouldPublishToolAuthNeededForTurn } from "./admission";
 import { unavailableMcpOperationalContext } from "./errors";
 import { runtimeResourcesForTurn } from "./file-resources";
 import { waitForTurnOperation } from "./sandbox-provision";
@@ -90,20 +101,37 @@ import type { sandboxArtifactRuntimeAdmission } from "./sandbox-route";
 import type {
   AttemptIdentityState,
   EventingState,
+  RenewalState,
   SandboxRuntimeState,
   WorkspaceRefState,
 } from "./turn-context";
 import {
   createSessionTitleAttemptToolDefinition,
+  routeAllowsSessionTitleRequests,
   sessionTitleToolPlan,
   shouldRequestMissingSessionTitle,
 } from "./session-title";
 import { resolveTurnSandboxAccess } from "./turn-sandbox-access";
 import { createListModelsAttemptToolDefinition } from "./list-models";
+import { createRefreshCredentialsAttemptToolDefinition } from "./refresh-credentials";
+import { codeSearchToolDefinitions, codeSearchWorkspaceFromChannel } from "./code-search";
 import { createWorkspaceSkillTools } from "./skill-tools";
 import { loadConfiguredBundledSkills } from "./skill-selection";
 import { guardSkillFilesystem } from "./skill-transfer";
-import type { RuntimeSkillActivation } from "@opengeni/runtime";
+import { turnCredentialRestriction } from "./credential-restriction";
+
+/** A linked turn's immutable policy must survive array and token boundaries. */
+export function linkedTurnFirstPartyPermissions(
+  selected: Permission[] | null,
+  linked: { permissions: Permission[]; permissionMode?: "legacy" | "explicit" } | null,
+): Permission[] | null {
+  if (!linked) return selected;
+  const permissions = (selected ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS).filter((permission) =>
+    hasPermission(linked.permissions, permission, linked.permissionMode),
+  );
+  requireExplicitPermissionDelegation(linked, permissions);
+  return permissions;
+}
 
 export type PrepareTurnToolPolicyDeps = {
   input: RunAgentTurnInput;
@@ -125,7 +153,6 @@ export type PrepareTurnToolRuntimeDeps = {
         input: import("../types").RunKnowledgeSourceSyncBatchInput,
       ) => Promise<import("../types").RunKnowledgeSourceSyncBatchResult>)
     | undefined;
-  selectedSkillActivations: readonly RuntimeSkillActivation[];
   input: RunAgentTurnInput;
   catalogSourceSettings: Settings;
   db: ActivityServices["db"];
@@ -134,7 +161,6 @@ export type PrepareTurnToolRuntimeDeps = {
   objectStorage: ActivityServices["objectStorage"];
   observability: ActivityServices["observability"];
   cancellationSignal: AbortSignal | undefined;
-  connectionCredentials: ActivityServices["connectionCredentials"];
   eventing: EventingState;
   attempt: AttemptIdentityState;
   sandboxState: SandboxRuntimeState;
@@ -149,10 +175,10 @@ export type PrepareTurnToolRuntimeDeps = {
   turnExecutionPolicy: ClaimTurnOk["turnExecutionPolicy"];
   trigger: ClaimTurnOk["trigger"];
   runSettings: GovernanceModelOk["runSettings"];
+  resolvedModel: GovernanceModelOk["resolvedModel"];
   lazyToolTransport: GovernanceModelOk["lazyToolTransport"];
   turnTools: ReturnType<typeof withFirstPartyTools>;
   connectionScope: { accountId: string; workspaceId: string };
-  hostCredentialRootSessionId: string | null;
   sandboxArtifactRuntime: ReturnType<typeof sandboxArtifactRuntimeAdmission>;
   activeSandboxBackend: Settings["sandboxBackend"] | undefined;
   groupBoxBackend: Settings["sandboxBackend"];
@@ -161,8 +187,18 @@ export type PrepareTurnToolRuntimeDeps = {
   credentialSubjectId: ClaimTurnOk["credentialSubjectId"];
   interactionInterventionResume: ClaimTurnOk["interactionInterventionResume"];
   runWorkspaceMutationForSandbox: SandboxTurnRuntime["runWorkspaceMutationForSandbox"];
+  /** Deployment and workspace allow the Jev-backed code_search tool. */
+  codeSearchEnabled: boolean;
+  /**
+   * False for an optional repository that sits this turn out after losing
+   * access (dropUnavailableOptionalRepositories), so no tool surface offers it.
+   */
+  retainsOptionalRepository?: (resource: ResourceRef) => boolean;
   throwIfWorkerShuttingDown: () => void;
   throwIfTurnCancelled: () => void;
+  /** Present when this turn resolves host-managed run credentials. */
+  runCredentialRenewals?: RenewalState | undefined;
+  runMcpCredentials?: RunMcpCredentials;
 };
 
 export async function prepareTurnToolPolicy(deps: PrepareTurnToolPolicyDeps) {
@@ -195,30 +231,36 @@ export async function prepareTurnToolPolicy(deps: PrepareTurnToolPolicyDeps) {
   // sessions follow the current configured MCP set,
   // while explicit, inherited-fixed, and legacy sessions remain narrowed
   // to their stored materialized allow-list.
-  const scheduledEffectiveMcpServerIds = (() => {
-    const value =
-      turn.metadata && typeof turn.metadata === "object" && !Array.isArray(turn.metadata)
-        ? (turn.metadata as Record<string, unknown>).scheduledEffectiveMcpServerIds
-        : null;
-    return Array.isArray(value) && value.every((id) => typeof id === "string")
-      ? [...new Set(value)].sort()
-      : null;
-  })();
-  const currentMcpServerIds = new Set(runSettings.mcpServers.map((server) => server.id));
-  const resolvedToolPolicy = resolveSessionToolPolicy({
+  const resolvedToolPolicy = resolveTurnToolPolicy({
     toolPolicy: session.toolPolicy,
-    sessionTools: scheduledEffectiveMcpServerIds ? turn.tools : session.tools,
-    availableMcpServerIds: scheduledEffectiveMcpServerIds
-      ? scheduledEffectiveMcpServerIds.filter((id) => currentMcpServerIds.has(id))
-      : [...currentMcpServerIds],
+    session,
+    turn,
+    availableMcpServerIds: runSettings.mcpServers.map((server) => server.id),
     defaultMcpServerIds:
-      scheduledEffectiveMcpServerIds ?? defaultSessionMcpServerIds(capabilitySettings.mcpServers),
+      scheduledTurnMcpServerIds(turn) === null && session.toolPolicy.mode === "workspace_default"
+        ? await workspaceSessionToolPolicyDefaultServerIds(
+            db,
+            input.workspaceId,
+            capabilitySettings,
+            fileAuthoritySubjectId ?? undefined,
+          )
+        : [],
   });
   const mcpAvailabilityNote = unavailableMcpOperationalContext({
     droppedIds: resolvedToolPolicy.effectivePolicy.droppedIds,
     droppedCount: resolvedToolPolicy.effectivePolicy.counts.dropped,
   });
-  const effectivePolicyTools = resolvedToolPolicy.toolRefs;
+  const families = resolveAgentToolFamilies(session.agent, {
+    productServerIds: new Set([
+      ...session.mcpServers.map((server) => server.id),
+      ...(session.toolPolicy.mode !== "workspace_default"
+        ? session.tools.map((tool) => tool.id)
+        : []),
+    ]),
+  });
+  const effectivePolicyTools = resolvedToolPolicy.toolRefs.filter(
+    (tool) => tool.kind !== "mcp" || families.allowsMcpServer(tool.id),
+  );
   const turnTools = withFirstPartyTools(runSettings, effectivePolicyTools);
   // §7.6 connection-credential provider — load (and decrypt) selected Variable Sets via the
   // host `sandboxSecrets` provider when bound; unset → today's local decrypt. Preserve the
@@ -349,7 +391,6 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
     objectStorage,
     observability,
     cancellationSignal,
-    connectionCredentials,
     eventing,
     attempt,
     sandboxState,
@@ -361,10 +402,10 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
     codexAppsCredentialId,
     turnExecutionPolicy,
     trigger,
-    runSettings,
+    runSettings: canonicalRunSettings,
+    resolvedModel,
     lazyToolTransport,
-    turnTools,
-    hostCredentialRootSessionId,
+    turnTools: canonicalTurnTools,
     sandboxArtifactRuntime,
     activeSandboxBackend,
     groupBoxBackend,
@@ -373,30 +414,36 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
     credentialSubjectId,
     interactionInterventionResume,
     runWorkspaceMutationForSandbox,
+    codeSearchEnabled,
+    retainsOptionalRepository,
     throwIfWorkerShuttingDown,
     throwIfTurnCancelled,
   } = deps;
 
+  const accountRoutes = expandMcpAccountRoutes({
+    settings: canonicalRunSettings,
+    tools: canonicalTurnTools,
+    bindings: turn.mcpAccountBindings,
+  });
+  const runSettings = accountRoutes.settings;
+  const turnTools = accountRoutes.tools;
+  const credentialRestriction = turnCredentialRestriction(turnExecutionPolicy, session.metadata);
   const toolContextPreparationStartedAt = performance.now();
   throwIfWorkerShuttingDown();
   throwIfTurnCancelled();
-  const mcpCredentialRootSessionId =
-    connectionCredentials?.mcpCredentials && hostCredentialRootSessionId
-      ? hostCredentialRootSessionId
-      : input.sessionId;
   // Connection credentials and the optional Apps credential are resolved
   // independently. Inference auth is never an Apps fallback.
   const rawResolveCredential = connectionTokenResolverForTurn({
     db,
     settings: runSettings,
-    connectionCredentials: connectionCredentials ?? null,
+    canonicalMcpServerIds: canonicalRunSettings.mcpServers
+      .filter((server) => server.connectionRef)
+      .map((server) => server.id),
     accountId: input.accountId,
     workspaceId: input.workspaceId,
     sessionId: input.sessionId,
-    rootSessionId: mcpCredentialRootSessionId,
     attemptId: input.attemptId,
     turn,
-    observability,
   });
   const personalConnectionDelegations = turn.personalConnectionDelegations;
   const delegatedMembershipChecks = new Map<string, Promise<boolean>>();
@@ -463,16 +510,24 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       return;
     }
     await eventing.publish!(
-      [{ type: "tool.auth_needed", payload: rollingSafeToolAuthNeededPayload(payload) }],
+      [
+        {
+          type: "tool.auth_needed",
+          payload: rollingSafeToolAuthNeededPayload(
+            accountRouteAuthNeededPayload(payload, turn.mcpAccountBindings),
+          ),
+        },
+      ],
       true,
     );
   };
-  const selectedApiIntegrationServerIds = new Set(turnTools.map((tool) => tool.id));
   const apiIntegrationMcpServers = buildApiIntegrationMcpServers({
     settings: runSettings,
-    integrations: installedApiIntegrations.filter((integration) =>
-      selectedApiIntegrationServerIds.has(integration.serverId),
-    ),
+    integrations: expandApiIntegrationAccountRoutes({
+      integrations: installedApiIntegrations,
+      bindings: turn.mcpAccountBindings,
+      tools: turnTools,
+    }),
     authority: {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
@@ -493,7 +548,9 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
     sessionId: input.sessionId,
     attemptId: input.attemptId,
     turn,
-    resources: mergeResourceRefs(session.resources, turn.resources),
+    resources: mergeResourceRefs(session.resources, turn.resources).filter(
+      (resource) => retainsOptionalRepository?.(resource) ?? true,
+    ),
     tools: turnTools,
     resolveCredential,
   });
@@ -535,25 +592,27 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
   );
   if (linkedAuthority && !linkedAuthority.authorized)
     throw new Error("Native identity link was revoked");
-  const effectiveFirstPartyPermissions = linkedAuthority
-    ? (session.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS).filter(
-        (permission) => hasPermission(linkedAuthority.permissions, permission),
-      )
-    : session.firstPartyMcpPermissions;
-  const selectedFirstPartyMcpTools = allowedFirstPartyMcpToolsForSession(
-    runSettings,
-    session.firstPartyMcpTools,
+  const effectiveFirstPartyPermissions = linkedTurnFirstPartyPermissions(
+    session.firstPartyMcpPermissions,
+    linkedAuthority,
+  );
+  const toolFamilies = resolveAgentToolFamilies(session.agent);
+  const selectedFirstPartyMcpTools = toolFamilies.firstPartyTools(
+    allowedFirstPartyMcpToolsForSession(runSettings, session.firstPartyMcpTools),
   );
   const titleToolPlan = sessionTitleToolPlan({
+    agentConfig: session.agent,
     tools: turnTools,
     selectedFirstPartyMcpTools,
     shouldRequestTitle: shouldRequestMissingSessionTitle({
+      agentConfig: session.agent,
       title: session.title,
       titleSource: session.titleSource,
       firstPartyMcpTools: selectedFirstPartyMcpTools,
       firstPartyMcpPermissions: effectiveFirstPartyPermissions,
     }),
     parallelGenerationAvailable: typeof runtime.generateSessionTitle === "function",
+    routeAllowsTitleRequests: routeAllowsSessionTitleRequests(resolvedModel),
   });
   const googleDrivePublicationAllowed =
     selectedFirstPartyMcpTools.includes("editable_artifact_export") &&
@@ -599,7 +658,16 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         outcome,
       }),
   };
-  const skillConfiguration = await getWorkspaceVideoGenerationPolicy(db, input.workspaceId);
+  // Independent scoped reads after the native-link authority check. Both
+  // finish before assembling the Skill index or preparing executable tools.
+  const [skillConfiguration, sharedSkillDescriptors] = await Promise.all([
+    getWorkspaceVideoGenerationPolicy(db, input.workspaceId),
+    listSkillDescriptors(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      ...(deps.fileAuthoritySubjectId ? { subjectId: deps.fileAuthoritySubjectId } : {}),
+    }),
+  ]);
   const bundledSkills = loadConfiguredBundledSkills({
     bundledSkillIds: session.bundledSkillIds,
     firstPartyTools: selectedFirstPartyMcpTools,
@@ -608,31 +676,28 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
   });
   const selectedSkills = [
     ...bundledSkills,
-    ...deps.selectedSkillActivations.map((entry) => ({ id: entry.id, artifact: entry.artifact })),
     ...session.skills.map((skill) => ({
       id: `session:${session.id}:${skill.name}`,
       artifact: skill,
     })),
   ];
-  const sharedSkillDescriptors = await listSkillDescriptors(db, {
-    accountId: input.accountId,
-    workspaceId: input.workspaceId,
-    ...(deps.fileAuthoritySubjectId ? { subjectId: deps.fileAuthoritySubjectId } : {}),
-  });
-  const skillCatalog = [
-    ...sharedSkillDescriptors
-      .filter((entry) => entry.activationMode === "workspace_managed")
-      .map((entry) => ({
-        id: entry.id,
-        name: entry.title,
-        description: entry.description,
-      })),
-    ...selectedSkills.map((entry) => ({
-      id: entry.id,
-      name: entry.artifact.name,
-      description: entry.artifact.description || entry.artifact.name,
-    })),
-  ];
+  const skillCatalog =
+    toolFamilies.skills === false
+      ? []
+      : [
+          ...sharedSkillDescriptors
+            .filter((entry) => entry.activationMode === "workspace_managed")
+            .map((entry) => ({
+              id: entry.id,
+              name: entry.title,
+              description: entry.description,
+            })),
+          ...selectedSkills.map((entry) => ({
+            id: entry.id,
+            name: entry.artifact.name,
+            description: entry.artifact.description || entry.artifact.name,
+          })),
+        ];
   const skillTools = createWorkspaceSkillTools({
     db,
     settings: runSettings,
@@ -647,6 +712,19 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       executionGeneration: attempt.executionGeneration,
     },
     selected: selectedSkills,
+    modelToolOutputTruncationTokens: () =>
+      eventing.modelRunSettings.modelToolOutputTruncationTokens,
+    onSkillReadHistoryLookupFailed: () =>
+      observability.warn("skill_read history lookup failed; returning the full Skill text", {
+        errorCode: "skill_read_history_lookup_failed",
+        origin: "worker",
+      }),
+    skillReadTelemetry: {
+      // Set once agent build freezes this turn's model-visible Skill index.
+      indexedSkillIds: () => eventing.modelVisibleSkillIds,
+      observe: (observation) => recordSkillRead(observability, observation),
+    },
+    observeSkillCheckout: (observation) => recordSkillCheckout(observability, observation),
     filesystem: async () => {
       throwIfWorkerShuttingDown();
       throwIfTurnCancelled();
@@ -744,6 +822,63 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       return ((await prepared.ready) ?? prepared).attemptToolEnvironment;
     },
   });
+  const codeSearchTools = codeSearchToolDefinitions({
+    enabled: codeSearchEnabled,
+    settings: runSettings,
+    backend: activeSandboxBackend ?? groupBoxBackend,
+    machineWorkspaceRoot: sandboxState.machinePrimarySession?.workspaceRoot ?? null,
+    observability,
+    // OpenGeni's Jev key pays for these calls whatever model billing the
+    // workspace uses; record them per workspace so the cost stays visible.
+    recordUsage: async (usage) => {
+      const shared = {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        sourceResourceType: "code_search",
+        sourceResourceId: usage.operationId,
+        sessionId: input.sessionId,
+        turnId: turn.id,
+        turnAttemptId: input.attemptId,
+      };
+      await recordUsageEvent(db, {
+        ...shared,
+        eventType: "code_search.jev_input_tokens",
+        quantity: usage.jevInputTokens,
+        unit: "tokens",
+        idempotencyKey: `usage:code_search.jev_input_tokens:${input.attemptId}:${usage.operationId}`,
+      });
+      await recordUsageEvent(db, {
+        ...shared,
+        eventType: "code_search.jev_cost",
+        quantity: Math.round(usage.jevCostUsd * 1_000_000),
+        unit: "usd_micros",
+        idempotencyKey: `usage:code_search.jev_cost:${input.attemptId}:${usage.operationId}`,
+      });
+    },
+    workspace: async () => {
+      throwIfWorkerShuttingDown();
+      throwIfTurnCancelled();
+      const access = await resolveTurnSandboxAccess(
+        sandboxState,
+        media.sdkOwnedSandboxSession,
+        "code_search requires a sandbox or Connected Machine.",
+      );
+      const machineRoot = sandboxState.machinePrimarySession?.workspaceRoot;
+      const runAs = sandboxRunAs(runSettings);
+      return codeSearchWorkspaceFromChannel(
+        new SandboxChannelAService({
+          session: access.session,
+          workspaceRoot: machineRoot ?? "/workspace",
+          ...(machineRoot ? { providerPathMode: "workspace-relative" as const } : {}),
+          leaseEpoch: access.leaseEpoch,
+          ...(runAs ? { runAs } : {}),
+        }),
+      );
+    },
+  });
+  const attemptToolFamilies = resolveAgentToolFamilies(session.agent, {
+    hasSkills: skillCatalog.length > 0,
+  });
   const attemptToolDefinitions = [
     ...(operationReadStore
       ? [
@@ -758,87 +893,34 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       : []),
     ...skillTools,
     ...sourceTools,
+    ...(deps.runCredentialRenewals
+      ? [
+          createRefreshCredentialsAttemptToolDefinition({
+            refresh: async () => {
+              const renewals = deps.runCredentialRenewals!;
+              const controller = renewals.runCredentialRenewal;
+              if (!controller) return "not_provisioned";
+              renewals.runCredentialRenewalOutcome = null;
+              await controller.refreshNow();
+              return renewals.runCredentialRenewalOutcome ?? "completed";
+            },
+          }),
+        ]
+      : []),
     createListModelsAttemptToolDefinition({
       currentModelId: turnExecutionPolicy.productModelId,
       load: async () => {
         const currentCatalog = await resolveCatalogSettings(db, catalogSourceSettings);
         const currentSettings = currentCatalog.settings;
-        const xaiReadinessAuthority = xaiCatalogReadinessAuthority(turn, credentialSubjectId);
-        const [
-          connectionModelRestrictions,
-          policy,
-          codexSubscriptionActive,
-          xaiSubscriptionActive,
-          workspaceGatewayConnectionActive,
-          workspaceGatewayCustomModels,
-          openRouterConnectionActive,
-          workspaceOpenRouterCustomModels,
-          organizationGatewayConnectionActive,
-          organizationGatewayCustomModels,
-          organizationOpenRouterConnectionActive,
-          organizationOpenRouterCustomModels,
-        ] = await Promise.all([
-          getWorkspaceConnectionModelRestrictions(
-            db,
-            input.workspaceId,
-            xaiReadinessAuthority?.subjectId ?? credentialSubjectId ?? "worker:model-access",
-            xaiReadinessAuthority?.authoritySnapshot,
-          ),
-          getWorkspaceModelPolicy(db, input.workspaceId),
-          workspaceCodexSubscriptionActive(db, currentSettings, input.workspaceId),
-          xaiReadinessAuthority && currentSettings.supergrokSubscriptionEnabled
-            ? workspaceXaiSubscriptionActiveForAuthority(db, currentSettings, {
-                workspaceId: input.workspaceId,
-                ...xaiReadinessAuthority,
-              })
-            : false,
-          workspaceVercelAiGatewayConnectionActive(db, input.workspaceId),
-          listWorkspaceGatewayCustomModels(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-          }),
-          workspaceOpenRouterConnectionActive(db, input.workspaceId),
-          listWorkspaceOpenRouterCustomModels(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-          }),
-          organizationModelProviderConnectionActiveForWorkspace(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            providerKind: "vercel_gateway",
-          }),
-          listOrganizationModelProviderCustomModelsForWorkspace(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            providerKind: "vercel_gateway",
-          }),
-          organizationModelProviderConnectionActiveForWorkspace(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            providerKind: "openrouter",
-          }),
-          listOrganizationModelProviderCustomModelsForWorkspace(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            providerKind: "openrouter",
-          }),
-        ]);
+        const selectionInput = await loadWorkspaceModelSelectionInput(db, currentSettings, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          subjectId: turn.initiatingHumanSubjectId ?? credentialSubjectId ?? "worker:model-access",
+          xaiAuthoritySnapshot: turn.xaiProviderAccountAuthoritySnapshot,
+          claudeAuthoritySnapshot: turn.claudeProviderAccountAuthoritySnapshot,
+        });
         return {
-          selections: resolveWorkspaceModelSelection({
-            connectionModelRestrictions,
-            settings: currentSettings,
-            policy,
-            codexSubscriptionActive,
-            xaiSubscriptionActive,
-            workspaceGatewayConnectionActive,
-            workspaceGatewayCustomModels,
-            workspaceOpenRouterConnectionActive: openRouterConnectionActive,
-            workspaceOpenRouterCustomModels,
-            organizationGatewayConnectionActive,
-            organizationGatewayCustomModels,
-            organizationOpenRouterConnectionActive,
-            organizationOpenRouterCustomModels,
-          }),
+          selections: resolveWorkspaceModelSelection(selectionInput),
           modelNotes: currentCatalog.modelNotes,
         };
       },
@@ -866,6 +948,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       : []),
     ...createFirstPartyInteractionAttemptToolDefinitions({
       settings: runSettings,
+      ...(credentialRestriction ? { credentialRestriction } : {}),
       scope: {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -885,7 +968,8 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
     ...(googleDrivePublicationTool && googleDrivePublicationAllowed
       ? [googleDrivePublicationTool]
       : []),
-  ];
+    ...codeSearchTools,
+  ].filter((tool) => attemptToolFamilies.allowsFunctionTool(tool.modelName));
   recordTurnStartupPhase(observability, {
     phase: "tool_context_preparation",
     provider: turnExecutionPolicy.providerId,
@@ -924,10 +1008,12 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       "Connector attachment sandbox is unavailable",
     );
     const sandbox = sandboxAccess.sandbox;
+    const machineRoot = sandboxState.machinePrimarySession?.workspaceRoot;
     const runAs = sandboxRunAs(runSettings);
     const channel = new SandboxChannelAService({
       session: sandboxAccess.session,
-      workspaceRoot: "/workspace",
+      workspaceRoot: machineRoot ?? "/workspace",
+      ...(machineRoot ? { providerPathMode: "workspace-relative" as const } : {}),
       leaseEpoch: sandboxAccess.leaseEpoch,
       emit: async (events) => {
         await eventing.publish?.(events, true);
@@ -947,9 +1033,21 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       },
     });
   };
+  const initiatingHuman = await waitForTurnOperation(
+    resolveInitiatingHuman(
+      db,
+      deps.connectionScope,
+      turn.initiatingHumanSubjectId ?? null,
+      turn.id,
+    ),
+    cancellationSignal,
+    undefined,
+  );
   try {
     eventing.preparedTools = await waitForTurnOperation(
       runtime.prepareTools(githubRestMcp.settings, githubRestMcp.tools, {
+        ...(credentialRestriction ? { credentialRestriction } : {}),
+        mcpAccountLabels: accountRoutes.accountLabels,
         accountId: input.accountId,
         workspaceId: input.workspaceId,
         sessionId: input.sessionId,
@@ -962,8 +1060,18 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         subjectId: "worker:first-party-mcp",
         subjectLabel: "OpenGeni worker",
         ...(credentialSubjectId ? { credentialSubjectId } : {}),
+        initiatingHumanSubjectId: turn.initiatingHumanSubjectId ?? null,
+        initiatingHumanExternalIdentity: initiatingHuman?.externalIdentity ?? null,
+        sessionAttachedRemoteMcpTargets: selectedSessionRemoteMcpTargets(
+          githubRestMcp.settings,
+          session.mcpServers ?? [],
+          githubRestMcp.tools,
+          localMcpServers,
+        ),
+        ...(deps.runMcpCredentials ? { runMcpCredentials: deps.runMcpCredentials } : {}),
         ...(codexAppsAuth ? { codexAppsAuth } : {}),
         resolveCredential,
+        slackRateLimit: buildSlackApiRateLimiter(db, githubRestMcp.settings),
         ...(operationPersistence ? { mcpOperationPersistence: operationPersistence } : {}),
         ...(linkedAuthority
           ? {
@@ -985,6 +1093,44 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
           : {}),
         onAuthNeeded: publishToolAuthNeeded,
         materializeConnectorAttachments,
+        materializeGmailFile: async (request) => {
+          throwIfWorkerShuttingDown();
+          throwIfTurnCancelled();
+          if (!deps.objectStorage) throw new Error("Gmail file delivery requires object storage");
+          return await materializeGmailFile(request, {
+            workspaceId: input.workspaceId,
+            storage: deps.objectStorage,
+            downloadStorage: objectStorageForSandboxDownloads(
+              runSettings,
+              deps.objectStorage,
+              deps.activeSandboxBackend ?? deps.groupBoxBackend,
+            ),
+            materialize: materializeConnectorAttachments,
+            onCleanupFailure: (key) =>
+              console.warn("[gmail] Temporary transfer cleanup requires operator retry", {
+                objectKey: key,
+              }),
+          });
+        },
+        readGmailFile: async (request) => {
+          throwIfWorkerShuttingDown();
+          throwIfTurnCancelled();
+          const access = await resolveTurnSandboxAccess(
+            sandboxState,
+            media.sdkOwnedSandboxSession,
+            "Gmail attachment filesystem is unavailable",
+          );
+          const runAs = sandboxRunAs(runSettings);
+          const machineRoot = sandboxState.machinePrimarySession?.workspaceRoot;
+          const channel = new SandboxChannelAService({
+            session: access.session,
+            workspaceRoot: machineRoot ?? "/workspace",
+            ...(machineRoot ? { providerPathMode: "workspace-relative" as const } : {}),
+            leaseEpoch: access.leaseEpoch,
+            ...(runAs ? { runAs } : {}),
+          });
+          return await readGmailFileFromChannel(channel, request);
+        },
         refreshOwnedCommand: async (commandId) => {
           throwIfWorkerShuttingDown();
           throwIfTurnCancelled();
@@ -1002,13 +1148,10 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         localMcpServers,
         ...(deferNonEagerToolPreparation ? { deferNonEagerUntilToolDemand: true } : {}),
         onPreparationPhase: (measurement) => {
-          recordTurnStartupPhase(observability, {
-            phase: `tool_${measurement.phase}`,
+          recordToolPreparationPhase(observability, {
+            ...measurement,
             provider: turnExecutionPolicy.providerId,
             backend: activeSandboxBackend ?? groupBoxBackend,
-            outcome: measurement.outcome,
-            durationSeconds: measurement.durationSeconds,
-            count: githubRestMcp.tools.length,
           });
         },
         onAttemptToolCatalog: async (catalog) => {
@@ -1080,6 +1223,10 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         executionGeneration: attempt.executionGeneration,
       },
       cancellationSignal,
+      undefined,
+      {},
+      (name) => mcpToolDisplayMetadata(tools.mcpServers, name),
+      (entry) => toolFamilyForCatalogIdentity(entry, runSettings.mcpServers),
     );
     eventing.codemodeDispatcher.start();
   };
@@ -1098,12 +1245,14 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
   return {
     attemptConnectorActionBindings,
     connectorActionPolicy,
+    mcpServers: runSettings.mcpServers,
     generateSessionTitleInParallel: titleToolPlan.generateTitleInParallel,
     postToolPreparationStartedAt,
     preparationIndependentToolNames: [
       ...titleToolPlan.preparationIndependentToolNames,
       "skill_read",
     ],
+    codeSearchAvailable: codeSearchTools.length > 0,
     skillCatalog,
   };
 }