@opengeni/worker-bundle 2.2.0-canary.36855269964001 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "2.2.0-canary.36855269964001",
+  "version": "2.2.0",
   "description": "OpenGeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -54,25 +54,25 @@
   },
   "dependencies": {
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "^0.6.0-canary.36855269964001",
-    "@opengeni/capabilities": "^0.3.4-canary.36855269964001",
-    "@opengeni/codemode": "^0.6.5-canary.36855269964001",
-    "@opengeni/codex": "^0.2.29-canary.36855269964001",
-    "@opengeni/config": "^3.1.1-canary.36855269964001",
-    "@opengeni/contracts": "^5.4.0-canary.36855269964001",
-    "@opengeni/core": "^5.0.0-canary.36855269964001",
-    "@opengeni/db": "^6.2.0-canary.36855269964001",
-    "@opengeni/documents": "^0.8.37-canary.36855269964001",
-    "@opengeni/events": "^0.4.35-canary.36855269964001",
-    "@opengeni/github": "^0.8.0-canary.36855269964001",
-    "@opengeni/jev": "^0.2.0-canary.36855269964001",
-    "@opengeni/network": "^0.3.1-canary.36855269964001",
-    "@opengeni/observability": "^0.8.35-canary.36855269964001",
-    "@opengeni/runtime": "^4.3.0-canary.36855269964001",
-    "@opengeni/sdk": "^7.4.0-canary.36855269964001",
-    "@opengeni/storage": "^0.2.136-canary.36855269964001",
-    "@opengeni/tool-gateway": "^0.1.16-canary.36855269964001",
-    "@opengeni/xai-subscription": "^0.1.4-canary.36855269964001",
+    "@opengeni/agent-proto": "^0.6.0",
+    "@opengeni/capabilities": "^0.3.4",
+    "@opengeni/codemode": "^0.6.5",
+    "@opengeni/codex": "^0.2.29",
+    "@opengeni/config": "^3.1.1",
+    "@opengeni/contracts": "^5.4.0",
+    "@opengeni/core": "^5.0.0",
+    "@opengeni/db": "^6.2.0",
+    "@opengeni/documents": "^0.8.37",
+    "@opengeni/events": "^0.4.35",
+    "@opengeni/github": "^0.8.0",
+    "@opengeni/jev": "^0.2.0",
+    "@opengeni/network": "^0.3.1",
+    "@opengeni/observability": "^0.8.35",
+    "@opengeni/runtime": "^4.3.0",
+    "@opengeni/sdk": "^7.4.0",
+    "@opengeni/storage": "^0.2.136",
+    "@opengeni/tool-gateway": "^0.1.16",
+    "@opengeni/xai-subscription": "^0.1.4",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-run-admission.ts

@@ -1,16 +1,10 @@
 import { configuredStaticUsageLimits, type Settings } from "@opengeni/config";
 import { modelFundingForAdmission } from "@opengeni/core";
-import {
-  checkWorkspaceAllowance,
-  getBillingBalance,
-  isCodexBilledTurn,
-  sumUsageQuantity,
-} from "@opengeni/db";
+import { getBillingBalance, isCodexBilledTurn, sumUsageQuantity } from "@opengeni/db";
 import type { ControlActivityServices } from "./types";
 
 export type AgentRunAdmissionDenial =
   | "insufficient_credits"
-  | "allowance_exhausted"
   | "monthly_model_cost_limit"
   | "monthly_agent_run_limit";
 
@@ -22,8 +16,6 @@ export async function agentRunAdmissionDenial(
     workspaceId: string;
     model: string;
     requestedAgentRuns: number;
-    /** The accepted work's causal human, not the scheduler/service caller. */
-    initiatingHumanSubjectId?: string | null;
   },
 ): Promise<AgentRunAdmissionDenial | null> {
   const codexBilled = await isCodexBilledTurn({
@@ -54,14 +46,6 @@ export async function agentRunAdmissionDenial(
       if (balance.balanceMicros <= 0) return "insufficient_credits";
     }
   }
-  if (!externallyBilled) {
-    const refusal = await checkWorkspaceAllowance(services.db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      subjectId: input.initiatingHumanSubjectId ?? null,
-    });
-    if (refusal) return refusal.code;
-  }
   if (
     services.settings.usageLimitsMode !== "static" &&
     services.settings.usageLimitsMode !== "managed"

package/src/activities/agent-turn/admission.ts

@@ -1,4 +1,4 @@
-import { checkWorkspaceAllowance, getBillingBalance, sumUsageQuantity } from "@opengeni/db";
+import { getBillingBalance, sumUsageQuantity } from "@opengeni/db";
 import {
   configuredStaticUsageLimits,
   resolveTurnExecutionPolicyV1,
@@ -8,7 +8,6 @@ import { selectCodexCredentialId } from "@opengeni/codex";
 import { directPersonalConnectionSubjectId } from "@opengeni/core";
 import type { TurnActivityServices as ActivityServices } from "../types";
 import {
-  type AllowanceExhaustedRefusal,
   type SessionEvent,
   type SessionTurn,
   type ToolAuthNeededPayload,
@@ -244,65 +243,12 @@ export class BudgetExhaustedError extends Error {
   constructor(
     message: string,
     readonly serializedRunState: string | null,
-    readonly allowance: AllowanceRefusal | null = null,
   ) {
     super(message);
     this.name = "BudgetExhaustedError";
   }
 }
 
-export type AllowanceRefusal = AllowanceExhaustedRefusal;
-
-/** Account allowance exhaustion is recoverable state, never a provider failure. */
-export class AllowanceExhaustedError extends Error {
-  readonly code = "allowance_exhausted";
-
-  constructor(readonly refusal: AllowanceRefusal) {
-    super(refusal.message);
-    this.name = "AllowanceExhaustedError";
-  }
-}
-
-/** Revalidate between paid calls without replaying provider work or reserving credits. */
-export async function ensureRunAllowedBetweenModelCalls(input: {
-  settings: Settings;
-  db: ActivityServices["db"];
-  accountId: string;
-  workspaceId: string;
-  isExternallyBilledTurn: boolean;
-  entitlements?: ActivityServices["entitlements"];
-  chargesOpenGeniCredits: boolean;
-  countsTowardTokenCap: boolean;
-  initiatingHumanSubjectId: string | null;
-  serializedRunState?: () => string | null;
-}): Promise<void> {
-  try {
-    await ensureRunAllowed(
-      input.settings,
-      input.db,
-      input.accountId,
-      input.workspaceId,
-      input.isExternallyBilledTurn,
-      input.entitlements,
-      input.chargesOpenGeniCredits,
-      input.countsTowardTokenCap,
-      input.initiatingHumanSubjectId,
-    );
-  } catch (limitError) {
-    let serializedRunState: string | null = null;
-    try {
-      serializedRunState = input.serializedRunState?.() ?? null;
-    } catch {
-      // Durable history remains authoritative when the SDK state cannot serialize.
-    }
-    throw new BudgetExhaustedError(
-      limitError instanceof Error ? limitError.message : String(limitError),
-      serializedRunState,
-      limitError instanceof AllowanceExhaustedError ? limitError.refusal : null,
-    );
-  }
-}
-
 // Exported for unit testing the external-billing bypass (codex-billing.test.ts); not
 // part of the activity surface. Takes the accepted policy's billing attribution and
 // the optional §7.5 P3 host `entitlements` port (when bound, its `admitRun` REPLACES
@@ -316,7 +262,6 @@ export async function ensureRunAllowed(
   entitlements?: ActivityServices["entitlements"],
   chargesOpenGeniCredits = !isExternallyBilledTurn,
   countsTowardTokenCap = !isExternallyBilledTurn,
-  initiatingHumanSubjectId: string | null = null,
 ): Promise<void> {
   // Upstream settlement and workspace-facing cost are independent. External
   // metering skips the token cap; free/subscription/workspace cost skips the
@@ -357,14 +302,6 @@ export async function ensureRunAllowed(
       throw new Error("insufficient OpenGeni credits");
     }
   }
-  if (chargesOpenGeniCredits) {
-    const refusal = await checkWorkspaceAllowance(db, {
-      accountId,
-      workspaceId,
-      subjectId: initiatingHumanSubjectId,
-    });
-    if (refusal) throw new AllowanceExhaustedError(refusal);
-  }
   if (settings.usageLimitsMode === "static" || settings.usageLimitsMode === "managed") {
     const limits = configuredStaticUsageLimits(settings);
     if (limits.maxMonthlyAgentRunsPerWorkspace) {

package/src/activities/agent-turn/claim.ts

@@ -62,8 +62,6 @@ import {
   turnExecutionPolicyBillingIdentity,
   legacyTurnExecutionPolicyInput,
   ensureRunAllowed,
-  AllowanceExhaustedError,
-  type AllowanceRefusal,
 } from "./admission";
 import { providerRecoveryCountFromMetadata, isWorkerShutdownCancellation } from "./errors";
 import { throwIfTurnOperationCancelled, waitForTurnOperation } from "./sandbox-provision";
@@ -370,27 +368,20 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
   // bypass OpenGeni credit/token gates)
   // AND the optional host `entitlements` port (when bound, its admitRun replaces
   // the local credit read). Unset port → today's local-ledger path.
-  let allowanceRefusal: AllowanceRefusal | null = null;
-  try {
-    await waitForTurnOperation(
-      ensureRunAllowed(
-        capabilitySettings,
-        db,
-        input.accountId,
-        input.workspaceId,
-        billingState.isExternallyBilledTurn,
-        entitlements,
-        billingState.chargesOpenGeniCredits,
-        billingState.countsTowardTokenCap,
-        turn.initiatingHumanSubjectId,
-      ),
-      cancellationSignal,
-      undefined,
-    );
-  } catch (error) {
-    if (!(error instanceof AllowanceExhaustedError)) throw error;
-    allowanceRefusal = error.refusal;
-  }
+  await waitForTurnOperation(
+    ensureRunAllowed(
+      capabilitySettings,
+      db,
+      input.accountId,
+      input.workspaceId,
+      billingState.isExternallyBilledTurn,
+      entitlements,
+      billingState.chargesOpenGeniCredits,
+      billingState.countsTowardTokenCap,
+    ),
+    cancellationSignal,
+    undefined,
+  );
   // Setup (variableSet load, MCP connects, sandbox restore) does not
   // stream and so never observes cancellation on its own; these explicit
   // checks let a graceful shutdown checkpoint the turn before the worker is
@@ -523,9 +514,6 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
       ...(inputSettlement.suppressGoalContinuation !== undefined
         ? { suppressGoalContinuation: inputSettlement.suppressGoalContinuation }
         : {}),
-      ...(inputSettlement.allowanceGoalPause
-        ? { allowanceGoalPause: inputSettlement.allowanceGoalPause }
-        : {}),
       events: inputs,
       ...(runState ? { runState } : {}),
       ...(compactionRequestFailure ? { compactionRequestFailure } : {}),
@@ -587,36 +575,6 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
     durationSeconds: (performance.now() - activityStarted) / 1_000,
   });
   const turnStartSettlementStartedAt = performance.now();
-  if (allowanceRefusal) {
-    // Claim has frozen the exact human, but no provider or sandbox has started.
-    // Use the same terminal valve as a post-response stop, retaining a usable
-    // session and a visible typed refusal instead of manufacturing a failure.
-    if (
-      !(await eventing.settle({
-        events: [
-          { type: "usage.exhausted", payload: allowanceRefusal },
-          {
-            type: "turn.completed",
-            payload: {
-              output: "",
-              segmentLimit: "budget_exhausted",
-              ...allowanceRefusal,
-            },
-          },
-          { type: "session.status.changed", payload: { status: "idle" } },
-        ],
-        turnStatus: "completed",
-        sessionStatus: "idle",
-        activeTurnId: null,
-        allowanceGoalPause: { rationale: allowanceRefusal.message },
-      }))
-    ) {
-      return { exit: claimedResult({ status: "cancelled" }) };
-    }
-    control.turnMetricOutcome = "completed";
-    control.activityStatus = "idle";
-    return { exit: claimedResult({ status: "idle" }) };
-  }
   if (
     !(await eventing.settle({
       events: [

package/src/activities/agent-turn/claude-usage-observer.ts

@@ -35,17 +35,6 @@ export async function createClaudeUsageObserver(
       .map(async (provider) => {
         const scope: Scope =
           provider.kind === "claude-subscription-workspace" ? "workspace" : "organization";
-        const binding = provider.anthropic?.credentialBinding;
-        if (binding && provider.apiKey)
-          return [
-            provider.id,
-            {
-              scope,
-              token: provider.apiKey,
-              expectedConnectionId: binding.connectionId,
-              expectedCredentialVersion: binding.credentialVersion,
-            },
-          ] as const;
         const credential = await readCredential(scope).catch(() => null);
         if (!credential || credential.token !== provider.apiKey) return null;
         return [
@@ -60,7 +49,7 @@ export async function createClaudeUsageObserver(
       }),
   );
   const captured = new Map(bindings.filter((binding) => binding !== null));
-  const observe = (providerId: string, response: Response) => {
+  return (providerId: string, response: Response) => {
     const binding = captured.get(providerId);
     if (!binding) return;
     const { scope, ...identity } = binding;
@@ -87,25 +76,4 @@ export async function createClaudeUsageObserver(
           : {}),
       });
   };
-  return Object.assign(observe, {
-    binding(providerId: string) {
-      return captured.get(providerId);
-    },
-    renew(
-      providerId: string,
-      credential: {
-        token: string;
-        connectionId: string;
-        credentialVersion: number;
-      },
-    ) {
-      const binding = captured.get(providerId);
-      if (
-        binding &&
-        binding.expectedConnectionId === credential.connectionId &&
-        binding.expectedCredentialVersion === credential.credentialVersion
-      )
-        captured.set(providerId, { ...binding, token: credential.token });
-    },
-  });
 }

package/src/activities/agent-turn/errors.ts

@@ -20,7 +20,6 @@ import {
   isModalTaskExecStartPreDispatchUnavailableError,
   isRoutingMutationOutcomeUnknownError,
   RoutingWorkspaceRootChangedError,
-  ResponsesStreamingTerminalError,
   SandboxMaterializationVerificationError,
   materializationVerificationDiagnostic,
   type MaterializationVerificationDiagnostic,
@@ -730,7 +729,6 @@ export function shouldRecoverCompactionProviderFailure(error: unknown): boolean
 export function classifyContextWindowOverflowError(
   error: unknown,
 ): { message: string; code?: string; detail?: string } | null {
-  if (isProviderSafetyRefusal(error)) return null;
   const fields = collectErrorStrings(error);
   const matched = fields.find(
     (value) =>
@@ -797,9 +795,6 @@ export function collectErrorStrings(value: unknown, seen = new WeakSet<object>()
   }
   seen.add(value);
   const out: string[] = [];
-  // This diagnostic is already provider-owned and byte-bounded. Do not widen
-  // generic detail traversal to arbitrary application payloads.
-  if (value instanceof ResponsesStreamingTerminalError) out.push(value.detail);
   const record = value as Record<string, unknown>;
   for (const key of ["message", "code", "type", "name", "param"]) {
     const field = record[key];
@@ -862,9 +857,6 @@ export function isExactStatuslessUpstreamConnectivityMessage(message: string): b
 }
 
 function providerSafetyRefusalDiagnostic(error: unknown): string | undefined {
-  if (error instanceof ResponsesStreamingTerminalError) {
-    return error.category === "safety" ? error.detail : undefined;
-  }
   return collectErrorStrings(error).find(
     (value) =>
       /^(?:content_policy_violation|content_filter|safety_violation|bio_policy|cyber_policy)$/.test(
@@ -878,9 +870,6 @@ function isProviderSafetyRefusal(error: unknown): boolean {
 }
 
 export function isTransientProviderError(error: unknown): boolean {
-  if (error instanceof ResponsesStreamingTerminalError) {
-    return error.category === "unavailable";
-  }
   // A semantic refusal can arrive inside a 5xx transport envelope.
   if (isProviderSafetyRefusal(error)) return false;
   const status =
@@ -1079,41 +1068,6 @@ function baseAgentRunFailurePayload(
       detail: safetyRefusalDiagnostic,
     };
   }
-  if (error instanceof ResponsesStreamingTerminalError) {
-    const quota =
-      error.category === "unknown" || error.category === "rate_limit"
-        ? classifyProviderQuotaExhaustionError({
-            code: error.code,
-            error: { code: error.code, type: error.type, message: error.detail },
-            retryAfterSeconds: error.retryAfterSeconds,
-          })
-        : null;
-    if (quota) {
-      return {
-        error: providerQuotaExhaustedMessage(quota.scope),
-        code: PROVIDER_QUOTA_EXHAUSTED_CODE,
-        retryable: false,
-        quotaScope: quota.scope,
-        detail: error.detail,
-      };
-    }
-    return {
-      error:
-        error.category === "rate_limit"
-          ? "Model provider rate limit hit. Try again in a minute or lower the reasoning effort."
-          : error.category === "unavailable"
-            ? "The model provider is temporarily unavailable. The same turn will retry after a short delay."
-            : "The model provider rejected the response. Automatic retries stopped.",
-      code:
-        error.category === "rate_limit"
-          ? "provider_rate_limited"
-          : error.category === "unavailable"
-            ? "provider_unavailable"
-            : "provider_request_rejected",
-      retryable: error.category === "rate_limit" || error.category === "unavailable",
-      detail: error.detail,
-    };
-  }
   const message = error instanceof Error ? error.message : String(error);
   const status =
     typeof error === "object" && error !== null

package/src/activities/agent-turn/failure-settlement.ts

@@ -1536,16 +1536,12 @@ export async function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgent
     if (
       !(await eventing.settle!({
         events: [
-          ...(error.allowance
-            ? [{ type: "usage.exhausted" as const, payload: error.allowance }]
-            : []),
           {
             type: "turn.completed",
             payload: {
               output: "",
               segmentLimit: "budget_exhausted",
               detail: error.message,
-              ...(error.allowance ?? {}),
             },
           },
           { type: "session.status.changed", payload: { status: "idle" } },
@@ -1553,7 +1549,6 @@ export async function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgent
         turnStatus: "completed",
         sessionStatus: "idle",
         activeTurnId: null,
-        ...(error.allowance ? { allowanceGoalPause: { rationale: error.allowance.message } } : {}),
       }))
     ) {
       return claimedResult({ status: "cancelled" });

package/src/activities/agent-turn/run-credentials.ts

@@ -28,8 +28,6 @@ import {
   type loadWorkspaceEnvironmentForRunWithCredentials,
 } from "../environment";
 import type { mergeResourceRefs } from "../common";
-import type { withFirstPartyTools } from "../goals";
-import { expandMcpAccountRoutes } from "../mcp-account-routes";
 import { startGitCredentialRenewalLoop } from "../git-credential-renewal";
 import {
   RUN_CREDENTIAL_EXPIRY_LEAD_MS,
@@ -76,7 +74,6 @@ import type {
 
 export type PrepareRunCredentialsDeps = {
   localMcpServerIds?: readonly string[];
-  turnTools: ReturnType<typeof withFirstPartyTools>;
   input: RunAgentTurnInput;
   settings: Settings;
   db: ActivityServices["db"];
@@ -156,14 +153,6 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
   const platformGitResources = turnResources.filter(
     (resource) => resource.kind !== "repository" || repositoryHasExplicitGitConnection(resource),
   );
-  // Credential targets follow the same accepted-account narrowing as execution.
-  // A canonical connection without an accepted account does not execute, and
-  // account-qualified aliases never inherit an attachment's product headers.
-  const accountRoutes = expandMcpAccountRoutes({
-    settings: runSettings,
-    tools: deps.turnTools,
-    bindings: turn.mcpAccountBindings,
-  });
 
   const runCredentialResolver =
     effectiveRunCredentialBackend === "none" || effectiveRunCredentialBackend === "selfhosted"
@@ -171,11 +160,10 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
       : await waitForTurnOperation(
           bindRunCredentialResolver({
             db,
-            settings: accountRoutes.settings,
+            settings: runSettings,
             initiatingHumanSubjectId: turn.initiatingHumanSubjectId ?? null,
             connectionCredentials: connectionCredentials ?? null,
             localMcpServerIds: deps.localMcpServerIds ?? [],
-            effectiveTools: accountRoutes.tools,
             accountId: input.accountId,
             workspaceId: input.workspaceId,
             session,
@@ -226,9 +214,9 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
     : null;
   const runMcpCredentials = new RunMcpCredentials(
     selectedSessionRemoteMcpTargets(
-      accountRoutes.settings,
+      runSettings,
       session.mcpServers ?? [],
-      accountRoutes.tools,
+      turn.tools ?? [],
       (deps.localMcpServerIds ?? []).map((id) => ({ id })),
     ),
     {

package/src/activities/agent-turn/run.ts

@@ -3,8 +3,6 @@ import {
   readActiveSandbox,
   getWorkspaceCredentialProvider,
   loadClaudeSubscriptionUsageCredential,
-  resolveClaudeSubscriptionCredential,
-  ClaudeSubscriptionReconnectRequired,
 } from "@opengeni/db";
 import { routingEnabled } from "../../sandbox-routing";
 import { createKnowledgeSourceSyncActivities } from "../knowledge-source-sync";
@@ -28,7 +26,6 @@ import {
 import {
   REMOTE_COMPACTION_V2_BETA_FEATURE,
   REMOTE_COMPACTION_V2_IMPLEMENTATION,
-  awaitModelCallAdmission,
   materializeSandboxFileDownloads,
   sandboxFileDownloadFailureNote,
   type SandboxFileDownload,
@@ -381,14 +378,12 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       getModelRunSettings: () => eventing.modelRunSettings,
       getExecutionGeneration: () => attempt.executionGeneration,
     });
-    const checkpointBeforeProviderDispatch = async () => {
-      await awaitModelCallAdmission();
-      await checkpointHistoryBeforeProviderDispatch(historySink, {
+    const checkpointBeforeProviderDispatch = () =>
+      checkpointHistoryBeforeProviderDispatch(historySink, {
         effectiveSandboxBackend: eventing.modelRunSettings.sandboxBackend,
         routingEnabled: routingEnabled(settings),
         readActiveSandbox: () => readActiveSandbox(db, input.workspaceId, input.sessionId),
       });
-    };
 
     try {
       const claimed = await claimTurnAttempt({
@@ -937,30 +932,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
               }),
           );
           const withClaudeUsage = <T>(fn: () => Promise<T>): Promise<T> =>
-            withClaudeUsageObserver(claudeUsageObserver, fn, async (providerId, headers) => {
-              const binding = claudeUsageObserver.binding(providerId);
-              if (!binding) return headers;
-              const credential = await resolveClaudeSubscriptionCredential(
-                db,
-                settings,
-                {
-                  accountId: input.accountId,
-                  workspaceId: input.workspaceId,
-                  scope: binding.scope,
-                },
-                {
-                  expectedConnectionId: binding.expectedConnectionId,
-                  expectedCredentialVersion: binding.expectedCredentialVersion,
-                },
-              );
-              if (!credential) return headers; // A replaced connection never lends its new token to this turn.
-              if ("reconnectRequired" in credential)
-                throw new ClaudeSubscriptionReconnectRequired();
-              claudeUsageObserver.renew(providerId, credential);
-              headers.set("authorization", `Bearer ${credential.token}`);
-              headers.delete("x-api-key");
-              return headers;
-            });
+            withClaudeUsageObserver(claudeUsageObserver, fn);
           const withCodex = <T>(fn: () => Promise<T>): Promise<T> =>
             codexContext ? codexRequestStorage.run(codexContext, fn) : fn();
           const withProviderRequestContext = <T>(fn: () => Promise<T>): Promise<T> =>
@@ -1203,7 +1175,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
           );
 
           const runCredentials = await prepareRunCredentials({
-            turnTools,
             localMcpServerIds: installedApiIntegrations.map((integration) => integration.serverId),
             input,
             settings,