@opengeni/worker-bundle 1.0.0-canary.1 → 1.0.0

package/src/activities/mcp-credentials.ts

@@ -1,47 +1,46 @@
 import type { Settings } from "@opengeni/config";
-import type { ConnectionCredentialsPort } from "@opengeni/contracts";
-import type { HostMcpAcceptedAuthority } from "@opengeni/contracts/host-mcp-bindings";
+import { stableJson } from "@opengeni/contracts";
 import {
   buildConnectionTokenResolver,
-  buildHostConnectionTokenResolver,
-  getSessionTurnForAttempt,
-  authorizeDirectHostMcpUse,
-  resolveAcceptedHostMcpBinding,
   resolveAcceptedConnectionUse,
-  sessionTenancyProductActivated,
   type Database,
   type ResolveConnectionCredentialInput,
   type ResolveConnectionCredentialResult,
   type SessionTurnForExecution,
 } from "@opengeni/db";
-import { recordTenancyCompatibilityLaneUse, type Observability } from "@opengeni/observability";
 import { mcpOperationAuthorityDigest } from "./mcp-operation-authority";
 
-const OPENGENI_CONNECTION_ID_PATTERN =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
-
-export function connectionTokenResolverForTurn(input: {
+type TurnConnectionInput = {
   db: Database;
   settings: Settings;
-  connectionCredentials?: ConnectionCredentialsPort | null;
   accountId: string;
   workspaceId: string;
   sessionId: string;
-  rootSessionId: string;
   attemptId: string;
   turn: SessionTurnForExecution;
+  /** Policy identities before account expansion; never used to select credentials. */
+  canonicalMcpServerIds?: readonly string[];
   authorizeAcceptedUse?: typeof resolveAcceptedConnectionUse;
-  /** Test seam; production always reads the canonical active-attempt projection. */
-  getHostTurnForAttempt?: typeof getSessionTurnForAttempt;
-  /** Test seam for the activation fence on pre-snapshot workspace refs. */
-  isSessionTenancyProductActivated?: typeof sessionTenancyProductActivated;
-  /** Optional; used only for content-free compatibility-lane counters. */
-  observability?: Observability | null | undefined;
-}): (request: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult> {
-  const hostResolver = input.connectionCredentials?.mcpCredentials;
-  const readHostTurn = input.getHostTurnForAttempt ?? getSessionTurnForAttempt;
-  const hostDb = input.db;
-  const nativeResolver = buildConnectionTokenResolver(input.db, input.settings);
+};
+
+type CredentialResolver = (
+  request: ResolveConnectionCredentialInput,
+) => Promise<ResolveConnectionCredentialResult>;
+
+export function connectionTokenResolverForTurn(input: TurnConnectionInput): CredentialResolver {
+  return bindNativeConnectionCredentialsToTurn(
+    input,
+    buildConnectionTokenResolver(input.db, input.settings),
+  );
+}
+
+/** Bind the ordinary credential resolver to one immutable accepted turn.
+ * Credential acquisition and refresh stay inside the native connection engine;
+ * this layer adds the exact execution context and physical-request checks. */
+export function bindNativeConnectionCredentialsToTurn(
+  input: TurnConnectionInput,
+  nativeResolver: CredentialResolver,
+): CredentialResolver {
   const recoveryEnabled = (serverId: string) =>
     input.settings.mcpServers.some(
       (server) =>
@@ -50,84 +49,14 @@ export function connectionTokenResolverForTurn(input: {
         server.operationRecovery !== undefined &&
         Object.keys(server.operationRecovery ?? {}).length > 0,
     );
-  const configuredResolver = hostResolver
-    ? async (
-        credentialRequest: ResolveConnectionCredentialInput,
-      ): Promise<ResolveConnectionCredentialResult> => {
-        let authorizedSnapshot: HostMcpAcceptedAuthority | undefined;
-        const wantsDigest = recoveryEnabled(credentialRequest.serverId);
-        const resolver = buildHostConnectionTokenResolver(hostResolver, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sessionId: input.sessionId,
-          rootSessionId: input.rootSessionId,
-          turnId: input.turn.id,
-          attemptId: input.attemptId,
-          executionGeneration: input.turn.executionGeneration,
-          initiator: input.turn.initiator,
-          initiatorContext: input.turn.initiatorContext,
-          surface: "model",
-          resolveAcceptedBinding: (request) => resolveAcceptedHostMcpBinding(hostDb, request),
-          // Only immutable captured direct-turn authority is currently supported.
-          // Direct, scheduled and exact causal/child snapshots are validated;
-          // no authority follows merely from a binding or creator identity.
-          authorizeDurableBinding: (request) =>
-            authorizeDirectHostMcpUse(
-              hostDb,
-              request,
-              wantsDigest
-                ? (snapshot) => {
-                    authorizedSnapshot = snapshot;
-                  }
-                : undefined,
-            ),
-          authorizeExecution: async (request) => {
-            // Native UUID references already pass the accepted-use boundary below.
-            // Legacy opaque host IDs retain their compatibility path, but not a
-            // right to execute after their accepted attempt has stopped.
-            if (
-              request.connectionRef.authoritySource !== "host" &&
-              (!request.connectionRef.connectionId ||
-                OPENGENI_CONNECTION_ID_PATTERN.test(request.connectionRef.connectionId))
-            )
-              return true;
-            if (!request.attemptId) return false;
-            const current = await readHostTurn(
-              hostDb,
-              request.workspaceId,
-              request.sessionId,
-              request.attemptId,
-            );
-            return (
-              current !== null &&
-              current.id === request.turnId &&
-              current.executionGeneration === request.executionGeneration
-            );
-          },
-        });
-        const result = await resolver(credentialRequest);
-        return result.status === "ok" && authorizedSnapshot
-          ? {
-              ...result,
-              operationAuthorityDigest: mcpOperationAuthorityDigest(credentialRequest, {
-                host: authorizedSnapshot,
-              }),
-            }
-          : result;
-      }
-    : nativeResolver;
-  const baseResolver = (request: ResolveConnectionCredentialInput) =>
-    input.connectionCredentials?.mcpAuthoritySource === "host" &&
-    request.connectionRef.authoritySource !== "host"
-      ? nativeResolver(request)
-      : configuredResolver(request);
+  const canonicalMcpServerIds = new Set(
+    input.canonicalMcpServerIds ??
+      input.settings.mcpServers.filter((server) => server.connectionRef).map((server) => server.id),
+  );
   return async (request) => {
-    // Host-owned refs carry explicit provenance because their opaque ids may
-    // themselves be valid UUIDs. They never enter OpenGeni's native connection
-    // authority or PostgreSQL UUID lookup; the bound host authorizes the exact
-    // immutable turn context on every credential request.
+    // Superseded host references must never fall through to native lookup,
+    // even when their opaque identifier happens to be a valid native UUID.
     if (request.connectionRef.authoritySource === "host") {
-      if (hostResolver) return await baseResolver(request);
       return {
         status: "auth_needed",
         reason: "unsupported_auth",
@@ -144,34 +73,31 @@ export function connectionTokenResolverForTurn(input: {
           : {}),
       };
     }
-    // Before explicit provenance existed, the public embedding contract let a
-    // bound host use any non-UUID opaque id. Preserve those frozen/stored refs
-    // during upgrades while keeping every UUID-shaped omission on OpenGeni's
-    // native accepted-use authority. New host refs must carry authoritySource
-    // so UUID-shaped host ids are unambiguous.
+    const accountBindings = input.turn.mcpAccountBindings ?? [];
+    const accountBinding = accountBindings.find((binding) => binding.serverId === request.serverId);
+    // Canonical policy identity cannot be invoked as a credential fallback once
+    // this turn selected explicit account routes for that connector.
     if (
-      hostResolver &&
-      input.connectionCredentials?.mcpAuthoritySource !== "host" &&
-      request.connectionRef.connectionId &&
-      !OPENGENI_CONNECTION_ID_PATTERN.test(request.connectionRef.connectionId)
+      (input.turn.mcpAccountBindings != null &&
+        !accountBinding &&
+        canonicalMcpServerIds.has(request.serverId)) ||
+      (!accountBinding &&
+        accountBindings.some((binding) => binding.canonicalServerId === request.serverId)) ||
+      (accountBinding &&
+        (request.connectionRef.connectionId !== accountBinding.connectionId ||
+          request.connectionRef.providerDomain !== accountBinding.providerDomain ||
+          request.connectionRef.kind !== accountBinding.kind ||
+          request.connectionRef.subjectScope !== accountBinding.subjectScope ||
+          stableJson(request.connectionRef) !== stableJson(accountBinding.connectionRef) ||
+          (accountBinding.subjectScope === "subject" &&
+            request.subjectId !== accountBinding.ownerSubjectId)))
     ) {
-      try {
-        return await baseResolver(request);
-      } catch {
-        return {
-          status: "auth_needed",
-          reason: "refresh_failed",
-          providerDomain: request.connectionRef.providerDomain,
-          authoritySource: "host",
-          ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
-          connectionId: request.connectionRef.connectionId,
-          ...(request.connectionRef.scopes ? { scopes: request.connectionRef.scopes } : {}),
-          ...(request.connectionRef.resource ? { resource: request.connectionRef.resource } : {}),
-          ...(request.connectionRef.selectedResources
-            ? { selectedResources: request.connectionRef.selectedResources }
-            : {}),
-        };
-      }
+      return {
+        status: "auth_needed",
+        reason: "personal_authority_unavailable",
+        providerDomain: request.connectionRef.providerDomain,
+        ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
+      };
     }
     const acceptedDelegation = input.turn.personalConnectionDelegations.find(
       (delegation) =>
@@ -191,9 +117,7 @@ export function connectionTokenResolverForTurn(input: {
     const subjectScope: "subject" | "workspace" =
       request.connectionRef.subjectScope === "subject" ? "subject" : "workspace";
     // Every subject-scoped request must match an exact connection frozen on the
-    // accepted turn. This also hard-fences pre-cutover common-user turns that
-    // lack a userDelegation: the DB resolver denies those rows because only a
-    // true legacy_user connection is eligible for bounded compatibility.
+    // accepted turn. The database then checks its immutable sender snapshot.
     if (
       subjectScope === "subject" &&
       (!acceptedDelegation || !request.connectionRef.connectionId)
@@ -205,31 +129,15 @@ export function connectionTokenResolverForTurn(input: {
         ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
       };
     }
-    // Workspace-scope requests now run through the same accepted-use authority
-    // (migration 0279): the exact workspace-owned connection is revalidated
-    // inside the canonical lifecycle fences and every use leaves an idempotent
-    // audit fact. A ref with no connection id is the bounded pre-snapshot
-    // legacy path - it cannot be authorized by exact identity, so it keeps the
-    // unprivileged resolution the old short-circuit used.
+    // Workspace connections also need an exact identity for accepted-use
+    // validation and attribution. Never rediscover a credential by domain here.
     if (subjectScope === "workspace" && !request.connectionRef.connectionId) {
-      if (
-        await (input.isSessionTenancyProductActivated ?? sessionTenancyProductActivated)(
-          input.db,
-          input.workspaceId,
-        )
-      ) {
-        return {
-          status: "auth_needed",
-          reason: "missing_connection",
-          providerDomain: request.connectionRef.providerDomain,
-          ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
-        };
-      }
-      // This lane writes no `connection_use_audit_facts` row, so this counter is
-      // the only evidence it was taken. Lane name only - never the server,
-      // provider domain, connection, or subject.
-      recordTenancyCompatibilityLaneUse(input.observability, "connection_pre_snapshot_ref");
-      return await baseResolver(request);
+      return {
+        status: "auth_needed",
+        reason: "missing_connection",
+        providerDomain: request.connectionRef.providerDomain,
+        ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
+      };
     }
     const credentialUseContext = {
       accountId: input.accountId,
@@ -299,50 +207,31 @@ export function connectionTokenResolverForTurn(input: {
         },
       };
     };
-    // One place records the `legacy_user` lane for both resolution paths: the
-    // scope comes back on the resolver result when the DB resolver authorized
-    // internally, and on the resolution itself when the host resolver did.
-    const recordAuthorizedScope = (scope: "workspace" | "user" | "legacy_user" | undefined) => {
-      if (scope === "legacy_user") {
-        recordTenancyCompatibilityLaneUse(input.observability, "connection_legacy_user");
-      }
-    };
-    if (!hostResolver) {
-      const result = await baseResolver({
-        ...request,
-        connectionUseContext: credentialUseContext,
-      });
-      if (result.status === "ok") recordAuthorizedScope(result.connectionUseAttribution?.scope);
-      return withProviderRequestAuthorization(result);
-    }
-    const authorization = await authorize(credentialUseContext);
-    if (authorization.status === "denied") {
+    const { subjectId: requestSubjectId, ...requestWithoutSubject } = request;
+    const result = await nativeResolver({
+      ...requestWithoutSubject,
+      ...(accountBinding?.connectionAuthorityGeneration !== undefined
+        ? { expectedAuthorityGeneration: accountBinding.connectionAuthorityGeneration }
+        : {}),
+      // Workspace authority has no personal owner, even when the turn has a
+      // causal human. Do not pass that human as credential ownership context.
+      ...(accountBinding?.subjectScope !== "workspace" && requestSubjectId !== undefined
+        ? { subjectId: requestSubjectId }
+        : {}),
+      connectionUseContext: credentialUseContext,
+    });
+    if (
+      accountBinding &&
+      result.status === "ok" &&
+      result.connectionId !== accountBinding.connectionId
+    ) {
       return {
         status: "auth_needed",
-        reason:
-          request.connectionRef.subjectScope === "subject"
-            ? "personal_authority_unavailable"
-            : "missing_connection",
-        providerDomain: request.connectionRef.providerDomain,
-        ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
+        reason: "personal_authority_unavailable",
+        providerDomain: accountBinding.providerDomain,
       };
     }
-    recordAuthorizedScope(authorization.attribution.scope);
-    const result = await baseResolver({
-      ...request,
-      connectionUseContext: credentialUseContext,
-      connectionUseAuthority: authorization.attribution,
-      connectionRef: {
-        ...request.connectionRef,
-        connectionId: authorization.attribution.connectionId,
-        kind: authorization.connectionKind,
-        subjectScope: authorization.attribution.scope === "workspace" ? "workspace" : "subject",
-      },
-      ...(authorization.attribution.ownerSubjectId
-        ? { subjectId: authorization.attribution.ownerSubjectId }
-        : {}),
-    });
-    return withProviderRequestAuthorization(result, authorization.attribution);
+    return withProviderRequestAuthorization(result);
   };
 }
 

package/src/activities/mcp-operation-authority.ts

@@ -1,23 +1,18 @@
 import { createHash } from "node:crypto";
 import { stableJson } from "@opengeni/contracts";
 import type { ConnectionUseAttribution } from "@opengeni/contracts/connection-authority";
-import type { HostMcpAcceptedAuthority } from "@opengeni/contracts/host-mcp-bindings";
 import type { ResolveConnectionCredentialInput } from "@opengeni/db";
 
 /** Metadata only. Callers must obtain authority from a current live fence.
  * This equality key is never authorization and never replaces physical-use checks. */
 export function mcpOperationAuthorityDigest(
   request: ResolveConnectionCredentialInput,
-  authority:
-    | {
-        native: ConnectionUseAttribution;
-        host?: never;
-        principal?: { kind: string; subjectId?: string };
-      }
-    | { host: HostMcpAcceptedAuthority; native?: never },
+  authority: {
+    native: ConnectionUseAttribution;
+    principal?: { kind: string; subjectId?: string };
+  },
 ): string {
   const n = authority.native;
-  const h = authority.host;
   const ref = request.connectionRef;
   const metadata = {
     version: 1,
@@ -31,7 +26,6 @@ export function mcpOperationAuthorityDigest(
       providerDomain: ref.providerDomain,
       kind: ref.kind,
       subjectScope: ref.subjectScope,
-      hostBinding: ref.hostBinding,
       scopes: ref.scopes ? [...ref.scopes].sort() : undefined,
       resource: ref.resource,
       selectedResources: ref.selectedResources
@@ -40,37 +34,18 @@ export function mcpOperationAuthorityDigest(
           )
         : undefined,
     },
-    native: n
-      ? {
-          organizationId: n.organizationId,
-          workspaceId: n.workspaceId,
-          sessionId: n.sessionId,
-          connectionId: n.connectionId,
-          connectionGeneration: n.connectionGeneration,
-          scope: n.scope,
-          ownerSubjectId: n.ownerSubjectId,
-          authorityId: n.authorityId,
-          grantId: n.grantId,
-          principal: "principal" in authority ? authority.principal : undefined,
-        }
-      : undefined,
-    host: h
-      ? {
-          accountId: h.accountId,
-          workspaceId: h.workspaceId,
-          targetSessionId: h.targetSessionId,
-          targetSessionVisibility: h.targetSessionVisibility,
-          targetSessionAuthorityEpoch: h.targetSessionAuthorityEpoch,
-          ownerSubjectId: h.ownerSubjectId,
-          ownerOrganizationMembershipId: h.ownerOrganizationMembershipId,
-          ownerMembershipAuthorizationRevision: h.ownerMembershipAuthorizationRevision,
-          bindingId: h.bindingId,
-          bindingGeneration: h.bindingGeneration,
-          definition: h.definition,
-          delegationId: h.delegationId,
-          delegationGeneration: h.delegationGeneration,
-        }
-      : undefined,
+    native: {
+      organizationId: n.organizationId,
+      workspaceId: n.workspaceId,
+      sessionId: n.sessionId,
+      connectionId: n.connectionId,
+      connectionGeneration: n.connectionGeneration,
+      scope: n.scope,
+      ownerSubjectId: n.ownerSubjectId,
+      authorityId: n.authorityId,
+      grantId: n.grantId,
+      principal: authority.principal,
+    },
   };
   return createHash("sha256").update(stableJson(metadata)).digest("hex");
 }

package/src/activities/model-call-fact-reconciler.ts

@@ -0,0 +1,112 @@
+import { randomUUID } from "node:crypto";
+import { listWorkspaceIdsAfter, reconcileModelCallFacts } from "@opengeni/db";
+import type { ControlActivityServices } from "./types";
+
+/** Recent charged calls are rechecked on every run; older gaps use the backfill script. */
+export const MODEL_CALL_FACT_RECONCILE_LOOKBACK_MS = 2 * 60 * 60 * 1_000;
+/** Skip the newest calls so a live fact write is not raced by its own repair. */
+export const MODEL_CALL_FACT_RECONCILE_SETTLE_MS = 10 * 60 * 1_000;
+export const MODEL_CALL_FACT_RECONCILE_WORKSPACE_LIMIT = 500;
+export const MODEL_CALL_FACT_RECONCILE_RUN_BUDGET_MS = 3 * 60 * 1_000;
+const WORKSPACE_PAGE_SIZE = 200;
+
+export type ReconcileRecentModelCallFactsResult = {
+  workspaces: number;
+  missing: number;
+  repaired: number;
+  unrepaired: number;
+  /** Workspaces with more missing facts than one bounded pass examines. */
+  truncatedWorkspaces: number;
+  failedWorkspaces: number;
+  budgetExhausted: boolean;
+};
+
+export type ModelCallFactReconcilerOptions = {
+  now?: () => number;
+  runBudgetMs?: number;
+  startAfterWorkspaceId?: () => string;
+  reconcile?: typeof reconcileModelCallFacts;
+  listWorkspaces?: typeof listWorkspaceIdsAfter;
+};
+
+/**
+ * Rebuild missing Insights call facts for recently charged model calls. Each
+ * workspace pass is bounded and idempotent, one failure never stops the rest,
+ * and each run starts at a random workspace so a run that exhausts its budget
+ * does not starve the same tail of workspaces every time.
+ */
+export function createModelCallFactReconcilerActivities(
+  services: () => Promise<ControlActivityServices>,
+  options: ModelCallFactReconcilerOptions = {},
+) {
+  const now = options.now ?? Date.now;
+  const runBudgetMs = options.runBudgetMs ?? MODEL_CALL_FACT_RECONCILE_RUN_BUDGET_MS;
+  const startAfterWorkspaceId = options.startAfterWorkspaceId ?? randomUUID;
+  const reconcile = options.reconcile ?? reconcileModelCallFacts;
+  const listWorkspaces = options.listWorkspaces ?? listWorkspaceIdsAfter;
+
+  async function reconcileRecentModelCallFacts(): Promise<ReconcileRecentModelCallFactsResult> {
+    const { db, observability } = await services();
+    const startedAt = now();
+    const until = new Date(startedAt - MODEL_CALL_FACT_RECONCILE_SETTLE_MS);
+    const since = new Date(until.getTime() - MODEL_CALL_FACT_RECONCILE_LOOKBACK_MS);
+    const result: ReconcileRecentModelCallFactsResult = {
+      workspaces: 0,
+      missing: 0,
+      repaired: 0,
+      unrepaired: 0,
+      truncatedWorkspaces: 0,
+      failedWorkspaces: 0,
+      budgetExhausted: false,
+    };
+    const start = startAfterWorkspaceId();
+    let cursor: string | null = start;
+    let wrapped = false;
+    while (true) {
+      const page = await listWorkspaces(db, { afterId: cursor, limit: WORKSPACE_PAGE_SIZE });
+      const ids = wrapped ? page.filter((id) => id <= start) : page;
+      for (const workspaceId of ids) {
+        if (now() - startedAt >= runBudgetMs) {
+          result.budgetExhausted = true;
+          break;
+        }
+        result.workspaces += 1;
+        try {
+          const outcome = await reconcile(db, {
+            workspaceId,
+            since,
+            until,
+            limit: MODEL_CALL_FACT_RECONCILE_WORKSPACE_LIMIT,
+          });
+          result.missing += outcome.missing;
+          result.repaired += outcome.repaired;
+          result.unrepaired += outcome.unrepaired;
+          if (outcome.truncated) result.truncatedWorkspaces += 1;
+        } catch (error) {
+          result.failedWorkspaces += 1;
+          observability.warn("model call fact reconciliation failed for a workspace", {
+            workspaceId,
+            errorName: error instanceof Error ? error.name : "unknown",
+          });
+        }
+      }
+      if (result.budgetExhausted) break;
+      if (wrapped && ids.length < page.length) break;
+      if (page.length < WORKSPACE_PAGE_SIZE) {
+        if (wrapped) break;
+        wrapped = true;
+        cursor = null;
+        continue;
+      }
+      cursor = page[page.length - 1]!;
+    }
+    if (result.failedWorkspaces > 0 || result.truncatedWorkspaces > 0 || result.budgetExhausted) {
+      observability.warn("model call fact reconciliation incomplete", { ...result });
+    } else if (result.missing > 0) {
+      observability.info("model call fact reconciliation", { ...result });
+    }
+    return result;
+  }
+
+  return { reconcileRecentModelCallFacts };
+}

package/src/activities/open-suffix-resume.ts

@@ -2,6 +2,7 @@ import type { Agent } from "@openai/agents";
 import {
   OPEN_SUFFIX_RUN_STATE_BLOB,
   approvalIdentifier,
+  withPublicApprovalFields,
   type HumanInputResponse,
   type SessionEvent,
 } from "@opengeni/contracts";
@@ -164,7 +165,7 @@ function memberResult(input: {
   };
 }
 
-async function resultItemForOpenSuffixMember(input: {
+export async function resultItemForOpenSuffixMember(input: {
   agent: Agent<any, any>;
   row: OpenSuffixPendingToolCall;
   trigger: Pick<SessionEvent, "type" | "payload">;
@@ -177,6 +178,18 @@ async function resultItemForOpenSuffixMember(input: {
   const name = toolNameFromCallItem(input.row.callItem);
   const rejected = (): { resultItem: Record<string, unknown>; eventOutput: unknown } => {
     const payload = input.trigger.payload as { message?: unknown; decision?: unknown };
+    if (
+      input.row.interruptionKind === "approval" &&
+      payload.decision === "reject" &&
+      !(typeof payload.message === "string" && payload.message.trim().length > 0)
+    ) {
+      // This approval was rejected before invocation, not interrupted during execution.
+      return memberResult({
+        callId: input.row.callId,
+        name,
+        output: "Tool approval was rejected. This proposed tool call was not executed.",
+      });
+    }
     const message =
       typeof payload.message === "string" && payload.message.trim().length > 0
         ? payload.message
@@ -380,7 +393,7 @@ export async function settleOpenSuffixResumeIfNeeded(input: {
         ? [
             {
               type: "session.requiresAction" as const,
-              payload: { approvals: requiresActionApprovals },
+              payload: { approvals: requiresActionApprovals.map(withPublicApprovalFields) },
             },
           ]
         : []),