@opengeni/worker-bundle 1.3.0 → 1.4.0

package/dist/activities/agent-turn/errors.d.ts

@@ -131,19 +131,7 @@ export declare function modelPreparationFailureEventPayload(error: unknown, dura
     failureCode?: "capture_in_progress" | "provider_recovery_in_progress" | "rotation_in_progress";
     retryable?: boolean;
 };
-/**
- * Recognize active-route transitions that cannot finish inside their
- * originating attempt. A Modal-home session may start on a Connected Machine
- * without creating or leasing its managed home box. When an explicit attach
- * clears the active pointer back to home, the pointer commit is authoritative,
- * but this attempt has no home session to serve the next sandbox operation.
- *
- * The Agents SDK may retain the typed routing error directly, through `cause`,
- * or inside an AggregateError from a parallel function-tool batch. Traverse
- * only those structural error links with a strict bound; never classify from
- * message text, which could originate in model or tool content.
- */
-export declare function sandboxRouteTransitionCode(error: unknown): "home_unavailable_this_turn" | "workspace_root_changed_this_turn" | "native_capabilities_changed_this_attempt" | null;
+export declare function sandboxRouteTransitionCode(error: unknown): "home_unavailable_this_turn" | "workspace_root_changed_this_turn" | "native_capabilities_changed_this_attempt" | "home_backend_recovery_pending" | null;
 export declare function isSandboxRouteTransitionError(error: unknown): boolean;
 /** Backward-compatible name for callers/tests that only exercised the original
  * machine-to-home transition. */

package/dist/activities/agent-turn/subscription-lease.d.ts

@@ -27,6 +27,7 @@ export declare class SubscriptionTurnLease {
     private heartbeatInFlight;
     private heartbeatTimer;
     private readonly now;
+    private readonly renewalIntervalMs;
     constructor(leaseDeps: SubscriptionLeaseDeps);
     private expired;
     markLost: (reason: LeaseLossReason) => void;

package/dist/activities/agent-turn/tool-policy.d.ts

@@ -1,4 +1,5 @@
-import { type ComputerToolMode, type LazyToolTransport } from "@opengeni/runtime";
+import { type ComputerToolMode, type LazyToolTransport, type OpenGeniRuntime } from "@opengeni/runtime";
+import type { TurnExecutionPolicyV1 } from "@opengeni/contracts";
 import { type ModelProviderApi, type ResolvedModelProvider, type Settings } from "@opengeni/config";
 import { type ModelAttachmentInputPolicy } from "../run-input.js";
 export declare function shouldStartOnTurnRecording(params: {
@@ -112,6 +113,14 @@ export declare function shouldDeferNonEagerToolPreparation(args: {
     triggerKind: "next" | "approval";
     triggerType: string;
 }): boolean;
+/**
+ * Resolve the provider routing/gating shape for an accepted turn. The current
+ * definition is projected back onto the verified frozen policy: a turn
+ * accepted before hosted web search was enabled keeps its frozen tool set on
+ * every recovery attempt (stable tool prefix, exact accepted definition); the
+ * next accepted logical turn resolves the newly enabled tool.
+ */
+export declare function resolveAcceptedTurnModel(runtime: Pick<OpenGeniRuntime, "resolveTurnModel">, settings: Settings, policy: TurnExecutionPolicyV1): ReturnType<OpenGeniRuntime["resolveTurnModel"]>;
 /**
  * Native web search is a runtime capability, not part of the session's MCP
  * allow-list. Attach it whenever the resolved provider advertises runnable

package/dist/activities/agent-turn/web-search.d.ts

@@ -0,0 +1,33 @@
+import type { AttemptToolDefinition } from "@opengeni/codemode";
+import { type WebSearchProviderToolName, type WebSearchSettings } from "@opengeni/config";
+import { type WebSearchBilling, type WebSearchCallScope } from "@opengeni/core";
+import type { Observability } from "@opengeni/observability";
+/**
+ * Which web search one turn gets: the provider's hosted tool, Opengeni's
+ * provider tools, or neither. Tool preparation and agent construction both
+ * call this with the same accepted model and settings, so they agree.
+ */
+export declare function turnWebSearchPlan(resolvedModel: {
+    configured: {
+        hostedWebSearch: boolean;
+    };
+    provider: {
+        kind?: string;
+    };
+} | null, settings: WebSearchSettings): {
+    hostedWebSearch: boolean;
+    providerTools: WebSearchProviderToolName[];
+};
+/**
+ * The `web_search` and `web_fetch` attempt tools for one turn. The caller
+ * decides which names the turn gets ({@link webSearchToolPlan}); this only
+ * builds them. Provider keys stay in the worker and never reach a sandbox.
+ */
+export declare function webSearchToolDefinitions(input: {
+    settings: WebSearchSettings;
+    tools: readonly WebSearchProviderToolName[];
+    scope: WebSearchCallScope;
+    billing: WebSearchBilling;
+    observability: Pick<Observability, "warn">;
+    fetch?: typeof fetch;
+}): AttemptToolDefinition[];

package/dist/activities/programmatic-approvals.d.ts

@@ -8,3 +8,20 @@ export declare function programmaticApproval(operation: CodemodeOperation): {
     requestId: string | undefined;
 };
 export declare function programmaticContinuationNote(operations: readonly CodemodeOperation[]): string | undefined;
+/**
+ * Recover committed programmatic approval waits/results before the first model
+ * request without turning lazy MCP preparation into a first-request barrier.
+ *
+ * Only eager servers may gate the first request. Resuming a stored operation
+ * needs the prepared attempt tool environment, so this waits for full tool
+ * preparation only when there is something to resume: an approval decision
+ * trigger, or a cheap durable read showing unfinished operations for this
+ * logical turn (which covers every recovery that has stored work). Every other
+ * turn sends its first request without waiting on any lazy server.
+ */
+export declare function recoverProgrammaticOperationsBeforeFirstRequest(input: {
+    approvalDecisionId: string | undefined;
+    hasUnfinishedOperations: () => Promise<boolean>;
+    toolPreparationReady: Promise<void> | null;
+    resumeApproved: (decisionOperationId: string | undefined) => Promise<CodemodeOperation[]> | undefined;
+}): Promise<CodemodeOperation[]>;

package/dist/{activities-control-PEXBWKQJ.js → activities-control-D5KVEPHI.js}

@@ -34,7 +34,7 @@ import {
   warnDrainSnapshotFailure,
   withFirstPartyTools,
   workflowIdForSession
-} from "./chunk-QUX5LT2B.js";
+} from "./chunk-BMTWULF7.js";
 import {
   inspectOpenSandboxKubernetesInventory,
   recordActiveUserGauges,
@@ -62,7 +62,7 @@ import {
   recordVerifiedSignupTrialSwitchGauge,
   recordWorkerDeathRecoveryMetrics,
   runtimeMetricsHooksForObservability
-} from "./chunk-XONQEVAD.js";
+} from "./chunk-FF4HPY7L.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/activities/knowledge-indexing.ts
@@ -8813,4 +8813,4 @@ export {
   createControlActivities,
   createControlActivitiesFromServices
 };
-//# sourceMappingURL=activities-control-PEXBWKQJ.js.map
+//# sourceMappingURL=activities-control-D5KVEPHI.js.map

package/dist/{activities-turn-W27A2SBO.js → activities-turn-4Z3M7Z3F.js}

@@ -99,7 +99,7 @@ import {
   withFirstPartyTools,
   wrapLazyTurnBoxWithRouting,
   wrapTurnBoxWithRouting
-} from "./chunk-QUX5LT2B.js";
+} from "./chunk-BMTWULF7.js";
 import {
   StreamTimingMetrics,
   makeMachineOpObserver,
@@ -132,7 +132,7 @@ import {
   runtimeMetricsHooksForObservability,
   sandboxAutomaticRecoveryOutcome,
   turnLifecycleMetricsFor
-} from "./chunk-XONQEVAD.js";
+} from "./chunk-FF4HPY7L.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -1193,12 +1193,14 @@ import {
 } from "@opengeni/db";
 
 // src/activities/agent-turn/subscription-lease.ts
+var HEARTBEAT_INTERVAL_MS = 6e4;
 var SubscriptionTurnLease = class {
   constructor(leaseDeps) {
     this.leaseDeps = leaseDeps;
     if (!Number.isFinite(leaseDeps.ttlMs) || leaseDeps.ttlMs <= 0)
       throw new Error("Subscription lease TTL must be positive");
     this.now = leaseDeps.now ?? (() => performance.now());
+    this.renewalIntervalMs = Math.min(HEARTBEAT_INTERVAL_MS, leaseDeps.ttlMs / 5);
   }
   held = false;
   lost = false;
@@ -1209,6 +1211,7 @@ var SubscriptionTurnLease = class {
   heartbeatInFlight = false;
   heartbeatTimer;
   now;
+  renewalIntervalMs;
   expired = (deadline) => deadline === null || !Number.isFinite(deadline) || this.now() >= deadline;
   markLost = (reason) => {
     if (this.lost) return;
@@ -1231,6 +1234,8 @@ var SubscriptionTurnLease = class {
       return;
     }
     if (this.heartbeatInFlight) return;
+    const renewAt = this.confirmedUntilMs - this.leaseDeps.ttlMs + this.renewalIntervalMs;
+    if (this.now() < renewAt) return;
     this.heartbeatInFlight = true;
     const priorDeadline = this.confirmedUntilMs;
     const startedAt = this.now();
@@ -1257,7 +1262,7 @@ var SubscriptionTurnLease = class {
   };
   startHeartbeat = () => {
     if (!this.leaseDeps.getTurnId() || this.heartbeatTimer) return;
-    this.heartbeatTimer = setInterval(() => void this.renew("timer"), 6e4);
+    this.heartbeatTimer = setInterval(() => void this.renew("timer"), HEARTBEAT_INTERVAL_MS);
     this.heartbeatTimer.unref?.();
   };
   stopHeartbeat = () => {
@@ -8101,6 +8106,13 @@ function programmaticContinuationNote(operations) {
     "Approval resumes the stored operation, not the earlier program's JavaScript stack. Read results with the current Codemode client's status/resume handle. Do not resubmit arguments for completed, running, waiting, or uncertain operations."
   ].join("\n");
 }
+async function recoverProgrammaticOperationsBeforeFirstRequest(input) {
+  if (input.approvalDecisionId === void 0 && !await input.hasUnfinishedOperations()) {
+    return [];
+  }
+  await input.toolPreparationReady;
+  return await input.resumeApproved(input.approvalDecisionId) ?? [];
+}
 
 // src/activities/agent-turn/turn-sandbox-access.ts
 function ownedTurnSandboxForAgent(sandboxState) {
@@ -10251,11 +10263,33 @@ async function runTurnStreamAttempt(deps) {
     control.activityStatus = "idle";
     return claimedResult({ status: "idle" });
   };
-  await eventing.toolPreparationReady;
-  const codemodeOperations = await eventing.codemodeDispatcher?.resumeApproved(
-    `sandbox:${input.attemptId}`,
-    trigger.type === "user.approvalDecision" ? trigger.payload.approvalId : void 0
-  ) ?? [];
+  const programmaticRecoveryStartedAt = performance.now();
+  let programmaticRecoveryOutcome = "failed";
+  const codemodeOperations = await recoverProgrammaticOperationsBeforeFirstRequest({
+    approvalDecisionId: trigger.type === "user.approvalDecision" ? trigger.payload.approvalId : void 0,
+    hasUnfinishedOperations: async () => (await listTurnCodemodeApprovals(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      sessionId: input.sessionId,
+      turnId: activeTurnId
+    })).length > 0,
+    toolPreparationReady: eventing.toolPreparationReady,
+    resumeApproved: (decisionOperationId) => eventing.codemodeDispatcher?.resumeApproved(
+      `sandbox:${input.attemptId}`,
+      decisionOperationId
+    )
+  }).then((operations) => {
+    programmaticRecoveryOutcome = "completed";
+    return operations;
+  }).finally(() => {
+    recordTurnStartupPhase(observability, {
+      phase: "programmatic_operation_recovery",
+      provider: turnExecutionPolicy.providerId,
+      backend: activeSandboxBackend ?? groupBoxBackend,
+      outcome: programmaticRecoveryOutcome,
+      durationSeconds: (performance.now() - programmaticRecoveryStartedAt) / 1e3
+    });
+  });
   codemodeContinuationNote = programmaticContinuationNote(codemodeOperations);
   programmaticApprovalAcknowledged = trigger.type === "user.approvalDecision" && codemodeOperations.some(
     (operation) => operation.operationId === trigger.payload.approvalId
@@ -12247,6 +12281,7 @@ import {
   desktopCapableBackend
 } from "@opengeni/runtime";
 import {
+  configuredModelForAcceptedTurnExecutionPolicy,
   isDirectOpenAiApiBaseUrl
 } from "@opengeni/config";
 
@@ -12523,6 +12558,16 @@ function shouldDeferNonEagerToolPreparation(args) {
     args.lazyToolTransport && args.progressiveDisclosureEnabled && args.triggerKind === "next" && (args.triggerType === "user.message" || args.triggerType === "system.update.delivered")
   );
 }
+function resolveAcceptedTurnModel(runtime, settings, policy) {
+  const current = runtime.resolveTurnModel(settings, policy.productModelId);
+  if (!current) return null;
+  const configured = configuredModelForAcceptedTurnExecutionPolicy(
+    current.configured,
+    current.provider,
+    policy
+  );
+  return configured === current.configured ? current : { ...current, configured };
+}
 function hostedWebSearchForTurn(resolvedModel, deploymentWebSearchEnabled) {
   return resolvedModel?.configured.hostedWebSearch ?? deploymentWebSearchEnabled;
 }
@@ -12713,10 +12758,7 @@ async function prepareGovernanceAndModel(deps) {
       baseRunSettings
     )
   );
-  const resolvedModel = runtime.resolveTurnModel(
-    capabilitySettings,
-    turnExecutionPolicy.productModelId
-  );
+  const resolvedModel = resolveAcceptedTurnModel(runtime, capabilitySettings, turnExecutionPolicy);
   const providerApi = resolvedModel?.provider.api ?? "responses";
   const nativeImageProviderBinding = providerApi === "responses" ? openAiHostedImageProviderBindingForTurn(capabilitySettings, resolvedModel) : null;
   const lazyToolTransport = lazyToolTransportForTurn(resolvedModel);
@@ -13476,6 +13518,7 @@ import {
   readLease as readLease2,
   accrueWarmSeconds,
   SandboxWorkspaceMutationFencedError,
+  SandboxWorkspaceMutationOutputRejectedError,
   retainWorkspaceMutationProcess,
   retainedProviderCommandPersistence,
   SandboxRetainedProcessPromotionFencedError
@@ -13483,6 +13526,7 @@ import {
 import { createProviderCommandRetainer } from "@opengeni/db/retained-provider-commands";
 import {
   RoutingMutationOutcomeUnknownError,
+  RoutingMutationOutputRejectedError,
   ProviderCommandStartOutcomeUnknownError,
   ProviderCommandObservationUnavailableError,
   isModalCommandStartOutcomeUnknownError as isModalCommandStartOutcomeUnknownError2,
@@ -13895,6 +13939,17 @@ function createSandboxTurnRuntime(deps) {
     try {
       await settleMutation("resolved");
     } catch (settlementError) {
+      if (settlementError instanceof SandboxWorkspaceMutationOutputRejectedError && settlementError.matchesPhysicalSettlement({
+        accountId: identity.accountId,
+        workspaceId: identity.workspaceId,
+        admission,
+        operation,
+        outcome: "resolved"
+      })) {
+        throw new RoutingMutationOutputRejectedError(operation, settlementError.code, {
+          cause: settlementError
+        });
+      }
       throw new RoutingMutationOutcomeUnknownError(
         operation,
         `Platform workspace mutation "${operation}" returned from the provider but lost its durable settlement fence; its outcome is unknown and it was not replayed`,
@@ -32769,7 +32824,8 @@ import {
 } from "@opengeni/runtime";
 import {
   ChannelAPartialMutationError as ChannelAPartialMutationError2,
-  RoutingMutationOutcomeUnknownError as RoutingMutationOutcomeUnknownError2
+  RoutingMutationOutcomeUnknownError as RoutingMutationOutcomeUnknownError2,
+  isRoutingMutationOutputRejectedError
 } from "@opengeni/runtime/sandbox";
 import { connectorAttachmentSandboxPath as connectorAttachmentSandboxPath2 } from "@opengeni/runtime";
 var ConnectorAttachmentMaterializationError = class extends Error {
@@ -32878,7 +32934,7 @@ async function materializeConnectorAttachmentsInChannel(channel, request, option
       attachments: receipts
     });
   } catch (error51) {
-    if (error51 instanceof ChannelAPartialMutationError2 || error51 instanceof RoutingMutationOutcomeUnknownError2) {
+    if (error51 instanceof ChannelAPartialMutationError2 || error51 instanceof RoutingMutationOutcomeUnknownError2 || isRoutingMutationOutputRejectedError(error51)) {
       throw error51;
     }
     throw new ConnectorAttachmentMaterializationError();
@@ -33492,7 +33548,8 @@ import {
   resolveTurnToolPolicy,
   scheduledTurnMcpServerIds,
   hasPermission as hasPermission2,
-  requireExplicitPermissionDelegation
+  requireExplicitPermissionDelegation,
+  createWebSearchBilling
 } from "@opengeni/core";
 import { SandboxChannelAService as SandboxChannelAService3 } from "@opengeni/runtime/sandbox";
 import { sandboxRunAs as sandboxRunAs4 } from "@opengeni/runtime";
@@ -33814,6 +33871,200 @@ function codeSearchToolDefinitions(input) {
   ];
 }
 
+// src/activities/agent-turn/web-search.ts
+import {
+  WEB_FETCH_TOOL_NAME,
+  WEB_SEARCH_TOOL_NAME,
+  webSearchCallPricing,
+  webSearchCreditMicros,
+  webSearchProviderConfig,
+  webSearchToolPlan
+} from "@opengeni/config";
+import {
+  WebSearchBillingRefusedError
+} from "@opengeni/core";
+import {
+  WEB_FETCH_TOOL_DESCRIPTION,
+  WEB_FETCH_RETAINED_MAX_CHARS,
+  WEB_SEARCH_TOOL_DESCRIPTION,
+  WebSearchProviderError,
+  WebToolArgumentError,
+  createWebFetchProvider,
+  createWebSearchProvider,
+  parseWebFetchArguments,
+  parseWebSearchArguments,
+  renderWebPageWindow,
+  renderWebSearchResults,
+  webFetchInputSchema,
+  webSearchInputSchema
+} from "@opengeni/runtime/web-search";
+function turnWebSearchPlan(resolvedModel, settings) {
+  return webSearchToolPlan(settings, {
+    hostedWebSearch: hostedWebSearchForTurn(resolvedModel, settings.webSearchEnabled),
+    // SuperGrok's native search is added by its transport, not as an agent
+    // tool, so provider tools would only duplicate it.
+    transportHostedSearch: resolvedModel?.provider.kind === "xai-subscription"
+  });
+}
+var PAGE_CACHE_ENTRIES = 16;
+function textResult2(text, isError) {
+  return { isError, content: [{ type: "text", text }] };
+}
+function settledCost(operationId, operation, provider, pricing, reportedCostMicros) {
+  const basis = pricing.explicit ? "configured_price" : reportedCostMicros !== void 0 ? "provider_reported" : "list_price";
+  const providerMicros = basis === "provider_reported" ? reportedCostMicros : pricing.providerMicros;
+  return {
+    operationId,
+    operation,
+    provider,
+    providerMicros,
+    creditMicros: webSearchCreditMicros(providerMicros, pricing.marginBps),
+    marginBps: pricing.marginBps,
+    basis
+  };
+}
+function providerFailure(error51) {
+  return `${error51.message}${error51.retryable ? ". You may retry shortly." : "."}`;
+}
+function webSearchToolDefinitions(input) {
+  const config2 = webSearchProviderConfig(input.settings);
+  if (!config2 || input.tools.length === 0) return [];
+  const adapterInput = {
+    timeoutMs: config2.timeoutMs,
+    ...input.fetch ? { fetch: input.fetch } : {}
+  };
+  const settle = async (cost) => {
+    try {
+      await input.billing.settle(input.scope, cost);
+    } catch (error51) {
+      input.observability.warn("web search usage settlement failed", {
+        operation: cost.operation,
+        provider: cost.provider,
+        error: error51 instanceof Error ? error51.message : String(error51)
+      });
+    }
+  };
+  const definitions = [];
+  if (input.tools.includes(WEB_SEARCH_TOOL_NAME)) {
+    const provider = createWebSearchProvider({ ...adapterInput, endpoint: config2.search });
+    const pricing = webSearchCallPricing(config2, "search");
+    definitions.push({
+      identity: { serverId: "opengeni", toolName: WEB_SEARCH_TOOL_NAME },
+      modelName: WEB_SEARCH_TOOL_NAME,
+      codemodePath: ["opengeni", WEB_SEARCH_TOOL_NAME],
+      title: "Search the web",
+      description: WEB_SEARCH_TOOL_DESCRIPTION,
+      inputSchema: webSearchInputSchema,
+      annotations: {
+        title: "Search the web",
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      },
+      source: "opengeni",
+      approval: "none",
+      execute: async (args, context) => {
+        let request;
+        try {
+          request = parseWebSearchArguments(args);
+          await input.billing.admit(input.scope, pricing.providerMicros);
+        } catch (error51) {
+          if (error51 instanceof WebToolArgumentError || error51 instanceof WebSearchBillingRefusedError)
+            return textResult2(error51.message, true);
+          throw error51;
+        }
+        try {
+          const response = await provider.search(request, { signal: context.signal });
+          await settle(
+            settledCost(
+              context.operationId,
+              "search",
+              config2.search.provider,
+              pricing,
+              response.reportedCostMicros
+            )
+          );
+          return textResult2(renderWebSearchResults(request.query, response.results), false);
+        } catch (error51) {
+          if (context.signal?.aborted) throw error51;
+          if (error51 instanceof WebSearchProviderError) {
+            return textResult2(`Web search failed: ${providerFailure(error51)}`, true);
+          }
+          throw error51;
+        }
+      }
+    });
+  }
+  if (input.tools.includes(WEB_FETCH_TOOL_NAME) && config2.fetch) {
+    const fetchEndpoint = config2.fetch;
+    const provider = createWebFetchProvider({ ...adapterInput, endpoint: fetchEndpoint });
+    const pricing = webSearchCallPricing(config2, "fetch");
+    const pages = /* @__PURE__ */ new Map();
+    definitions.push({
+      identity: { serverId: "opengeni", toolName: WEB_FETCH_TOOL_NAME },
+      modelName: WEB_FETCH_TOOL_NAME,
+      codemodePath: ["opengeni", WEB_FETCH_TOOL_NAME],
+      title: "Read a web page",
+      description: WEB_FETCH_TOOL_DESCRIPTION,
+      inputSchema: webFetchInputSchema,
+      annotations: {
+        title: "Read a web page",
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      },
+      source: "opengeni",
+      approval: "none",
+      execute: async (args, context) => {
+        let request;
+        try {
+          request = parseWebFetchArguments(args);
+        } catch (error51) {
+          if (error51 instanceof WebToolArgumentError) return textResult2(error51.message, true);
+          throw error51;
+        }
+        const cached2 = pages.get(request.url);
+        if (cached2) return textResult2(renderWebPageWindow(cached2, request), false);
+        try {
+          await input.billing.admit(input.scope, pricing.providerMicros);
+        } catch (error51) {
+          if (error51 instanceof WebSearchBillingRefusedError) return textResult2(error51.message, true);
+          throw error51;
+        }
+        try {
+          const page = await provider.fetch({ url: request.url }, { signal: context.signal });
+          await settle(
+            settledCost(
+              context.operationId,
+              "fetch",
+              fetchEndpoint.provider,
+              pricing,
+              page.reportedCostMicros
+            )
+          );
+          if (pages.size >= PAGE_CACHE_ENTRIES) {
+            pages.delete(pages.keys().next().value);
+          }
+          pages.set(request.url, {
+            ...page,
+            content: page.content.slice(0, WEB_FETCH_RETAINED_MAX_CHARS + 1)
+          });
+          return textResult2(renderWebPageWindow(page, request), false);
+        } catch (error51) {
+          if (context.signal?.aborted) throw error51;
+          if (error51 instanceof WebSearchProviderError) {
+            return textResult2(`Web fetch failed: ${providerFailure(error51)}`, true);
+          }
+          throw error51;
+        }
+      }
+    });
+  }
+  return definitions;
+}
+
 // src/activities/agent-turn/skill-tools.ts
 import { createHash as createHash13 } from "crypto";
 import {
@@ -33983,14 +34234,14 @@ async function readResult(files, identity, args, context, activeHistory) {
   if (args.listFiles === true) {
     return {
       kind: "list",
-      result: textResult2({ ...identity, ...listSkillPaths(files, PORTABLE_SKILL_MAX_FILES) })
+      result: textResult3({ ...identity, ...listSkillPaths(files, PORTABLE_SKILL_MAX_FILES) })
     };
   }
   const selected = readSkillFiles(files, args.paths);
   if (args.paths === void 0 && context.caller.kind === "model" && activeHistory && await inActiveHistory(activeHistory, identity, selected.files[0])) {
     return {
       kind: "already_in_context",
-      result: textResult2({
+      result: textResult3({
         ...identity,
         alreadyInContext: true,
         message: `Already in context: SKILL.md of ${JSON.stringify(args.skill)}${identity.revisionId ? ` revision ${identity.revisionId}` : ""} was returned earlier in this conversation and is unchanged. Use that copy. Re-read only if you need a fresh copy: call skill_read with paths ["SKILL.md"].`
@@ -33998,12 +34249,12 @@ async function readResult(files, identity, args, context, activeHistory) {
     };
   }
   if (args.paths !== void 0) {
-    return { kind: "files", result: textResult2({ ...identity, ...selected }) };
+    return { kind: "files", result: textResult3({ ...identity, ...selected }) };
   }
   const scripts = skillScriptIndex(files);
   return {
     kind: "full",
-    result: textResult2({ ...identity, ...selected, ...scripts ?? {} })
+    result: textResult3({ ...identity, ...selected, ...scripts ?? {} })
   };
 }
 function observe(telemetry, read) {
@@ -34040,7 +34291,7 @@ function withSkillUse(read, origin, identity, telemetry) {
     return read.result;
   }
 }
-function textResult2(output) {
+function textResult3(output) {
   return {
     isError: false,
     content: [{ type: "text", text: JSON.stringify(output) }],
@@ -35504,6 +35755,19 @@ async function prepareTurnToolRuntime(deps) {
   const attemptToolFamilies = resolveAgentToolFamilies(session.agent, {
     hasSkills: skillCatalog.length > 0
   });
+  const webSearchTools = webSearchToolDefinitions({
+    settings: runSettings,
+    tools: turnWebSearchPlan(resolvedModel, runSettings).providerTools,
+    scope: {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      sessionId: input.sessionId,
+      turnId: turn.id,
+      attemptId: input.attemptId
+    },
+    billing: createWebSearchBilling({ db, settings: runSettings }),
+    observability
+  });
   const attemptToolDefinitions = [
     ...operationReadStore ? [
       createOperationReadAttemptToolDefinition({
@@ -35582,7 +35846,8 @@ async function prepareTurnToolRuntime(deps) {
       ...interactionInterventionResume ? { interventionResume: interactionInterventionResume } : {}
     }),
     ...googleDrivePublicationTool && googleDrivePublicationAllowed ? [googleDrivePublicationTool] : [],
-    ...codeSearchTools
+    ...codeSearchTools,
+    ...webSearchTools
   ].filter((tool) => attemptToolFamilies.allowsFunctionTool(tool.modelName));
   recordTurnStartupPhase(observability, {
     phase: "tool_context_preparation",
@@ -37401,7 +37666,7 @@ async function buildTurnAgent(deps) {
       variableNames: Object.keys(workspaceVariableSet.values)
     }
   } : {};
-  const hostedWebSearch = hostedWebSearchForTurn(resolvedModel, runSettings.webSearchEnabled);
+  const hostedWebSearch = turnWebSearchPlan(resolvedModel, runSettings).hostedWebSearch;
   const resolveImageReferences = async (references) => await resolveImageGenerationReferencesForTool({
     db,
     objectStorage,
@@ -40683,4 +40948,4 @@ export {
   createTurnActivities,
   createTurnActivitiesFromServices
 };
-//# sourceMappingURL=activities-turn-W27A2SBO.js.map
+//# sourceMappingURL=activities-turn-4Z3M7Z3F.js.map