@opengeni/worker-bundle 2.2.0 → 2.2.1-canary.36927100590001

package/src/activities/agent-turn/session-title.ts

@@ -12,6 +12,7 @@ import {
   ReasoningEffort,
   type FirstPartyMcpToolName,
   type Permission,
+  type ResolvedAgentConfig,
   type ToolRef,
 } from "@opengeni/contracts";
 
@@ -23,6 +24,7 @@ const SESSION_TITLE_DESCRIPTION =
 export function shouldRequestMissingSessionTitle(input: {
   title: string | null;
   titleSource: "user" | "agent" | null;
+  agentConfig?: ResolvedAgentConfig | null;
   firstPartyMcpTools: readonly FirstPartyMcpToolName[];
   firstPartyMcpPermissions: readonly Permission[] | null;
 }): boolean {
@@ -30,7 +32,9 @@ export function shouldRequestMissingSessionTitle(input: {
   const needsSemanticTitle =
     input.titleSource !== "user" && (!title || title === AUTOMATIC_SESSION_TITLE_FALLBACK);
   if (!needsSemanticTitle) return false;
-  if (!input.firstPartyMcpTools.includes("set_session_title")) return false;
+  // Configured sessions title through the runtime, not an opted-in capability.
+  // Legacy sessions keep their exact selected-tool and permission admission.
+  if (!input.agentConfig && !input.firstPartyMcpTools.includes("set_session_title")) return false;
   const permissions = input.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS;
   return hasPermission([...permissions], "sessions:control");
 }
@@ -51,6 +55,7 @@ export function routeAllowsSessionTitleRequests(
 
 export function sessionTitleToolPlan(input: {
   tools: readonly ToolRef[];
+  agentConfig?: ResolvedAgentConfig | null;
   selectedFirstPartyMcpTools: readonly FirstPartyMcpToolName[];
   shouldRequestTitle: boolean;
   parallelGenerationAvailable: boolean;
@@ -63,7 +68,8 @@ export function sessionTitleToolPlan(input: {
 } {
   const titleToolAvailable =
     input.shouldRequestTitle &&
-    input.tools.some((tool) => tool.kind === "mcp" && tool.id === "opengeni");
+    (input.agentConfig != null ||
+      input.tools.some((tool) => tool.kind === "mcp" && tool.id === "opengeni"));
   const titleRequestAllowed = titleToolAvailable && input.routeAllowsTitleRequests;
   const generateTitleInParallel = titleRequestAllowed && input.parallelGenerationAvailable;
   const promoteTitleTool = titleRequestAllowed && !generateTitleInParallel;

package/src/activities/agent-turn/stream-attempt.ts

@@ -1,5 +1,8 @@
 import { measureMcpPhase, withMcpCallIdentity } from "@opengeni/observability";
 import {
+  appendSessionHistoryItems,
+  sessionTurnFinalReplyFacts,
+  sessionTurnHasFinalReplyNudge,
   getSessionEvent,
   getHumanInputResumeForEvent,
   getSessionHumanInputRequest,
@@ -85,19 +88,20 @@ import {
 import {
   OPEN_SUFFIX_RUN_STATE_BLOB,
   resolveWorkspaceAgentHumanInputEnabled,
+  withPublicApprovalFields,
   type RetainedArtifactMetadata,
   type SessionEvent,
   type SessionTurn,
 } from "@opengeni/contracts";
 import { createModelCheckpointMemoryCollector } from "../../model-checkpoint-memory-collector";
+import { createModelCallAdmission } from "./model-call-admission";
 
 import {
   assertWorkspaceHumanInputAllowed,
   stableHumanInputRequestId,
   stableInteractionInterventionId,
   stableInteractionInterventionOperationId,
-  BudgetExhaustedError,
-  ensureRunAllowed,
+  ensureRunAllowedBetweenModelCalls,
 } from "./admission";
 import {
   compactionFailureReason,
@@ -141,6 +145,7 @@ import {
 import { inputWaitReply, latestDurableTurnMessageText } from "./input-wait-reply";
 import { waitForTurnOperation } from "./sandbox-provision";
 import { createSharedRigSetupCoordinator } from "./sandbox-shared-preparation";
+import { finalReplyNudge, needsFinalReply } from "./final-reply";
 
 import type { CompactionSummarizer } from "../context-compaction";
 import type { TurnExecutionPolicyV1 } from "@opengeni/contracts";
@@ -235,6 +240,7 @@ export type TurnStreamAttemptDeps = {
   groupBoxBackend: Settings["sandboxBackend"];
   turnExecutionPolicy: TurnExecutionPolicyV1;
   turn: Pick<SessionTurn, "initiator" | "initiatorContext"> & {
+    initiatingHumanSubjectId: string | null;
     id: string;
     executionGeneration: number;
     model: string;
@@ -583,14 +589,41 @@ export async function runTurnStreamAttempt(
   // durably: the reply a wait-ended human turn records on turn.completed.
   let latestAssistantMessageText: string | null = null;
   let workerPreparationTotalRecorded = false;
+  let toolsExecuted = false;
+  let finalReplyNudged = false;
+  const revalidateModelCallAdmission = async () => {
+    await historySink.reconcileConversationTruth({ requireDurable: true });
+    await ensureRunAllowedBetweenModelCalls({
+      settings,
+      db,
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      isExternallyBilledTurn: billingState.isExternallyBilledTurn,
+      entitlements,
+      chargesOpenGeniCredits: billingState.chargesOpenGeniCredits,
+      countsTowardTokenCap: billingState.countsTowardTokenCap,
+      initiatingHumanSubjectId: turn.initiatingHumanSubjectId,
+    });
+  };
   const runStreamAttempt = async (options: {
     requireTerminalModelResponse: boolean;
-  }): Promise<RunAgentTurnResult> => {
+  }): Promise<RunAgentTurnResult | "reply_nudge"> => {
     if (!runInput) {
       throw new Error("Run input was not prepared");
     }
-    const responseCountBeforeStream = modelResponseState.responseCount;
+    // The previous stream was persisted before compaction; the sink is now
+    // seeded from its durable replacement. Do not reconcile the old prefix
+    // against that replacement while checking the next stream's admission.
     eventing.stream = undefined;
+    // Compaction commits its paid usage and replacement history before this
+    // boundary, both during preparation and in-activity recovery. Revalidate
+    // the accepted turn's frozen human before another stream can dispatch.
+    if (options.requireTerminalModelResponse) await revalidateModelCallAdmission();
+    const modelCallAdmission = createModelCallAdmission({
+      signal: runtimeCancellationSignal,
+      admit: revalidateModelCallAdmission,
+    });
+    const responseCountBeforeStream = modelResponseState.responseCount;
     eventing.batcher = null;
     // The SDK emits every processed call item for one model response before
     // it emits any result for that response. Keep that response-local batch
@@ -806,6 +839,8 @@ export async function runTurnStreamAttempt(
         }
         attempt.modelRequestStarted = true;
         return await runtime.runStream(agent, runInput!, eventing.modelRunSettings, {
+          beforeModelRequest: modelCallAdmission.beforeModelRequest,
+          onModelResponse: modelCallAdmission.onModelResponse,
           signal: runtimeCancellationSignal,
           sandboxEnvironment,
           onModelVisibleContext: async (snapshot) => {
@@ -941,7 +976,13 @@ export async function runTurnStreamAttempt(
     if (leases.xai.lost) {
       throw new Error("xAI credential lease expired before the model run");
     }
-    eventing.stream = await withProviderRequestContext(runStreamOnce);
+    try {
+      eventing.stream = await withProviderRequestContext(runStreamOnce);
+    } catch (error) {
+      modelCallAdmission.fail(error);
+      modelCallAdmission.close();
+      throw error;
+    }
     // Bounded provider label for the streaming SLIs — the resolved registry
     // provider id (or the built-in OpenAI/Azure provider), never a raw
     // user-supplied model string.
@@ -1094,35 +1135,22 @@ export async function runTurnStreamAttempt(
           await historySink.reconcileConversationTruth();
           turnLifecycleMetricsFor(observability).progress({ attemptId: input.attemptId });
           modelCheckpointMemoryCollector.schedule(observability);
-          try {
-            await ensureRunAllowed(
-              settings,
-              db,
-              input.accountId,
-              input.workspaceId,
-              billingState.isExternallyBilledTurn,
-              entitlements,
-              billingState.chargesOpenGeniCredits,
-              billingState.countsTowardTokenCap,
-            );
-          } catch (limitError) {
-            // Capture the run state at the boundary so the budget valve in
-            // the outer catch can end this segment gracefully with full
-            // conversation context preserved for the post-top-up resume.
-            let serializedRunState: string | null = null;
-            try {
-              serializedRunState = media.compactMediaRunState(
-                String(eventing.stream.state.toString()),
-              );
-            } catch {
-              serializedRunState = null;
-            }
-            throw new BudgetExhaustedError(
-              limitError instanceof Error ? limitError.message : String(limitError),
-              serializedRunState,
-            );
-          }
+          await ensureRunAllowedBetweenModelCalls({
+            settings,
+            db,
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            isExternallyBilledTurn: billingState.isExternallyBilledTurn,
+            entitlements,
+            chargesOpenGeniCredits: billingState.chargesOpenGeniCredits,
+            countsTowardTokenCap: billingState.countsTowardTokenCap,
+            initiatingHumanSubjectId: turn.initiatingHumanSubjectId,
+            serializedRunState: () =>
+              media.compactMediaRunState(String(eventing.stream!.state.toString())),
+          });
         }
+        // Release only after both the debit and frozen-human admission finish.
+        modelCallAdmission.settle(next.value);
         const durableSdkEvent = generatedImageReceipt
           ? compactGeneratedImageSdkEvent(next.value, generatedImageReceipt)
           : next.value;
@@ -1159,6 +1187,7 @@ export async function runTurnStreamAttempt(
         }
         const completedToolCall = completedToolCallFromSdkEvent(durableSdkEvent);
         if (completedToolCall) {
+          toolsExecuted = true;
           retainedScreenshotMetadata =
             media.retainedScreenshotReceiptsByCallId.get(completedToolCall.callId) ?? null;
           const typedScreenshot = retainedScreenshotMetadata
@@ -1396,6 +1425,7 @@ export async function runTurnStreamAttempt(
         }
       }
     } catch (error) {
+      modelCallAdmission.fail(error);
       // Event processing can fail while SDK completion is still pending.
       // Close this stream before any failure publication; a legitimate
       // compaction retry may start a new, independently fenced generation.
@@ -1451,6 +1481,7 @@ export async function runTurnStreamAttempt(
       }
       throw error;
     } finally {
+      modelCallAdmission.close();
       if (!streamDone) {
         // ReadableStream cancellation synchronously trips the Agents SDK's
         // abort controller, but its returned promise may wait for an
@@ -1472,7 +1503,10 @@ export async function runTurnStreamAttempt(
     // External Codemode stays reachable until finalization. Close wait
     // admission before any terminal output/history decision, and drain an
     // already-admitted wait before consulting the actual runner-yield latch.
-    await eventing.preparedTools?.inputWaitYield?.sealForSettlement(runtimeCancellationSignal);
+    // Drain trusted receipts before deciding whether an empty stream may need
+    // a handoff. Do not terminally seal the attempt until that decision: the
+    // one same-turn stream still uses the ordinary input-wait admission gate.
+    await eventing.preparedTools?.inputWaitYield?.drainForHandoff(runtimeCancellationSignal);
     if (
       options.requireTerminalModelResponse &&
       !eventing.preparedTools?.inputWaitYield?.yielded &&
@@ -1585,6 +1619,7 @@ export async function runTurnStreamAttempt(
       }
     }
     if (eventing.stream.interruptions.length > 0) {
+      await eventing.preparedTools?.inputWaitYield?.sealForSettlement(runtimeCancellationSignal);
       await historySink.reconcileConversationTruth({ requireDurable: true });
       const approvals = runtime.serializeApprovals(eventing.stream.interruptions);
       const humanInputInterruptions =
@@ -1702,9 +1737,11 @@ export async function runTurnStreamAttempt(
                     type: "session.requiresAction" as const,
                     payload: {
                       approvals: approvals.map((approval) =>
-                        withMcpToolDisplayMetadata(
-                          eventing.preparedTools?.mcpServers ?? [],
-                          approval,
+                        withPublicApprovalFields(
+                          withMcpToolDisplayMetadata(
+                            eventing.preparedTools?.mcpServers ?? [],
+                            approval,
+                          ),
                         ),
                       ),
                     },
@@ -1739,6 +1776,60 @@ export async function runTurnStreamAttempt(
     const finalOutput = String(
       requireAgentStreamFinalOutput(eventing.stream.finalOutput, inputWaitYielded),
     );
+    const durableReplyFacts =
+      !inputWaitYielded && finalOutput.trim().length === 0
+        ? await sessionTurnFinalReplyFacts(db, input.workspaceId, input.sessionId, activeTurnId)
+        : { toolsExecuted: false, completedGoal: false };
+    let emptyFinalReply = false;
+    if (
+      needsFinalReply({
+        output: finalOutput,
+        inputWaitYielded:
+          inputWaitYielded || eventing.preparedTools?.inputWaitYield?.requested === true,
+        interrupted: false, // interruption settlement returned above
+        maintenance: turn.source === "compaction",
+        toolsExecuted: toolsExecuted || finalReplyNudged || durableReplyFacts.toolsExecuted,
+        completedGoal: durableReplyFacts.completedGoal,
+      })
+    ) {
+      await historySink.reconcileConversationTruth({ requireDurable: true });
+      // Consult retained truth, including inactive compacted rows, so an
+      // attempt replacement or compaction cannot spend this bound again.
+      if (
+        finalReplyNudged ||
+        (await sessionTurnHasFinalReplyNudge(
+          db,
+          input.workspaceId,
+          input.sessionId,
+          activeTurnId,
+          finalReplyNudge(activeTurnId).content[0]!.text,
+        ))
+      ) {
+        // A second empty response is a delivery-quality notice, not failed
+        // execution: preserve goal continuation and later machine-input wakes.
+        emptyFinalReply = true;
+      } else {
+        const appended = await appendSessionHistoryItems(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sessionId: input.sessionId,
+          turnId: activeTurnId,
+          expectedExecutionGeneration: attempt.executionGeneration,
+          expectedAttemptId: input.attemptId,
+          items: [
+            {
+              position: await nextSessionHistoryPosition(db, input.workspaceId, input.sessionId),
+              item: finalReplyNudge(activeTurnId),
+            },
+          ],
+        });
+        if (!appended) throw new TurnAttemptFencedError("turn ended before final reply handoff");
+        finalReplyNudged = true;
+        await prepareRunAttemptInput();
+        return "reply_nudge";
+      }
+    }
+    await eventing.preparedTools?.inputWaitYield?.sealForSettlement(runtimeCancellationSignal);
     // The final output is the newest message this stream completed, already
     // durable with its provider identity and phase. A phase-less settlement
     // copy is published only when this stream did not complete that text.
@@ -1773,7 +1864,11 @@ export async function runTurnStreamAttempt(
             : [{ type: "agent.message.completed" as const, payload: { text: finalOutput } }]),
           {
             type: "turn.completed",
-            payload: { output: finalOutput, ...(reply === null ? {} : { reply }) },
+            payload: {
+              output: finalOutput,
+              ...(reply === null ? {} : { reply }),
+              ...(emptyFinalReply ? { emptyFinalReply: true } : {}),
+            },
           },
           { type: "session.status.changed", payload: { status: "idle" } },
         ],
@@ -1834,6 +1929,9 @@ export async function runTurnStreamAttempt(
   ) {
     return claimedResult({ status: "cancelled" });
   }
+  // Preparation may have spent the last allowance on a completed summary.
+  // Neither the title sidecar nor ordinary inference may dispatch afterward.
+  await revalidateModelCallAdmission();
   if (
     turn.source !== "compaction" &&
     generateSessionTitleInParallel &&
@@ -1871,11 +1969,19 @@ export async function runTurnStreamAttempt(
   }
   try {
     let retriedAfterCompaction = false;
+    finalReplyNudged = await sessionTurnHasFinalReplyNudge(
+      db,
+      input.workspaceId,
+      input.sessionId,
+      activeTurnId,
+      finalReplyNudge(activeTurnId).content[0]!.text,
+    );
     while (true) {
       try {
         const result = await runStreamAttempt({
           requireTerminalModelResponse: retriedAfterCompaction,
         });
+        if (result === "reply_nudge") continue;
         if (retriedAfterCompaction) {
           observability.info("context compaction recovery succeeded after in-activity retry", {
             sessionId: input.sessionId,

package/src/activities/agent-turn/tool-environment.ts

@@ -68,8 +68,10 @@ import {
   buildApiIntegrationMcpServers,
   resolveCatalogSettings,
   resolveWorkspaceModelSelection,
+  loadWorkspaceCodexModelAvailability,
   withFrozenPersonalConnectionDelegations,
-  resolveSessionToolPolicy,
+  resolveTurnToolPolicy,
+  scheduledTurnMcpServerIds,
   hasPermission,
 } from "@opengeni/core";
 import { loadWorkspaceEnvironmentForRunWithCredentials } from "../environment";
@@ -87,6 +89,7 @@ import { SandboxChannelAService } from "@opengeni/runtime/sandbox";
 import { sandboxRunAs } from "@opengeni/runtime";
 import {
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  resolveAgentToolFamilies,
   type ResourceRef,
   type ToolAuthNeededPayload,
 } from "@opengeni/contracts";
@@ -124,6 +127,7 @@ import { codeSearchToolDefinitions, codeSearchWorkspaceFromChannel } from "./cod
 import { createWorkspaceSkillTools } from "./skill-tools";
 import { loadConfiguredBundledSkills } from "./skill-selection";
 import { guardSkillFilesystem } from "./skill-transfer";
+import { turnCredentialRestriction } from "./credential-restriction";
 
 export type PrepareTurnToolPolicyDeps = {
   input: RunAgentTurnInput;
@@ -223,38 +227,36 @@ export async function prepareTurnToolPolicy(deps: PrepareTurnToolPolicyDeps) {
   // sessions follow the current configured MCP set,
   // while explicit, inherited-fixed, and legacy sessions remain narrowed
   // to their stored materialized allow-list.
-  const scheduledEffectiveMcpServerIds = (() => {
-    const value =
-      turn.metadata && typeof turn.metadata === "object" && !Array.isArray(turn.metadata)
-        ? (turn.metadata as Record<string, unknown>).scheduledEffectiveMcpServerIds
-        : null;
-    return Array.isArray(value) && value.every((id) => typeof id === "string")
-      ? [...new Set(value)].sort()
-      : null;
-  })();
-  const currentMcpServerIds = new Set(runSettings.mcpServers.map((server) => server.id));
-  const resolvedToolPolicy = resolveSessionToolPolicy({
+  const resolvedToolPolicy = resolveTurnToolPolicy({
     toolPolicy: session.toolPolicy,
-    sessionTools: scheduledEffectiveMcpServerIds ? turn.tools : session.tools,
-    availableMcpServerIds: scheduledEffectiveMcpServerIds
-      ? scheduledEffectiveMcpServerIds.filter((id) => currentMcpServerIds.has(id))
-      : [...currentMcpServerIds],
+    session,
+    turn,
+    availableMcpServerIds: runSettings.mcpServers.map((server) => server.id),
     defaultMcpServerIds:
-      scheduledEffectiveMcpServerIds ??
-      (session.toolPolicy.mode === "workspace_default"
+      scheduledTurnMcpServerIds(turn) === null && session.toolPolicy.mode === "workspace_default"
         ? await workspaceSessionToolPolicyDefaultServerIds(
             db,
             input.workspaceId,
             capabilitySettings,
             fileAuthoritySubjectId ?? undefined,
           )
-        : []),
+        : [],
   });
   const mcpAvailabilityNote = unavailableMcpOperationalContext({
     droppedIds: resolvedToolPolicy.effectivePolicy.droppedIds,
     droppedCount: resolvedToolPolicy.effectivePolicy.counts.dropped,
   });
-  const effectivePolicyTools = resolvedToolPolicy.toolRefs;
+  const families = resolveAgentToolFamilies(session.agent, {
+    productServerIds: new Set([
+      ...session.mcpServers.map((server) => server.id),
+      ...(session.toolPolicy.mode !== "workspace_default"
+        ? session.tools.map((tool) => tool.id)
+        : []),
+    ]),
+  });
+  const effectivePolicyTools = resolvedToolPolicy.toolRefs.filter(
+    (tool) => tool.kind !== "mcp" || families.allowsMcpServer(tool.id),
+  );
   const turnTools = withFirstPartyTools(runSettings, effectivePolicyTools);
   // §7.6 connection-credential provider — load (and decrypt) selected Variable Sets via the
   // host `sandboxSecrets` provider when bound; unset → today's local decrypt. Preserve the
@@ -421,6 +423,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
   });
   const runSettings = accountRoutes.settings;
   const turnTools = accountRoutes.tools;
+  const credentialRestriction = turnCredentialRestriction(turnExecutionPolicy, session.metadata);
   const toolContextPreparationStartedAt = performance.now();
   throwIfWorkerShuttingDown();
   throwIfTurnCancelled();
@@ -590,14 +593,16 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         (permission) => hasPermission(linkedAuthority.permissions, permission),
       )
     : session.firstPartyMcpPermissions;
-  const selectedFirstPartyMcpTools = allowedFirstPartyMcpToolsForSession(
-    runSettings,
-    session.firstPartyMcpTools,
+  const toolFamilies = resolveAgentToolFamilies(session.agent);
+  const selectedFirstPartyMcpTools = toolFamilies.firstPartyTools(
+    allowedFirstPartyMcpToolsForSession(runSettings, session.firstPartyMcpTools),
   );
   const titleToolPlan = sessionTitleToolPlan({
+    agentConfig: session.agent,
     tools: turnTools,
     selectedFirstPartyMcpTools,
     shouldRequestTitle: shouldRequestMissingSessionTitle({
+      agentConfig: session.agent,
       title: session.title,
       titleSource: session.titleSource,
       firstPartyMcpTools: selectedFirstPartyMcpTools,
@@ -669,20 +674,23 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
     workspaceId: input.workspaceId,
     ...(deps.fileAuthoritySubjectId ? { subjectId: deps.fileAuthoritySubjectId } : {}),
   });
-  const skillCatalog = [
-    ...sharedSkillDescriptors
-      .filter((entry) => entry.activationMode === "workspace_managed")
-      .map((entry) => ({
-        id: entry.id,
-        name: entry.title,
-        description: entry.description,
-      })),
-    ...selectedSkills.map((entry) => ({
-      id: entry.id,
-      name: entry.artifact.name,
-      description: entry.artifact.description || entry.artifact.name,
-    })),
-  ];
+  const skillCatalog =
+    toolFamilies.skills === false
+      ? []
+      : [
+          ...sharedSkillDescriptors
+            .filter((entry) => entry.activationMode === "workspace_managed")
+            .map((entry) => ({
+              id: entry.id,
+              name: entry.title,
+              description: entry.description,
+            })),
+          ...selectedSkills.map((entry) => ({
+            id: entry.id,
+            name: entry.artifact.name,
+            description: entry.artifact.description || entry.artifact.name,
+          })),
+        ];
   const skillTools = createWorkspaceSkillTools({
     db,
     settings: runSettings,
@@ -861,6 +869,9 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       );
     },
   });
+  const attemptToolFamilies = resolveAgentToolFamilies(session.agent, {
+    hasSkills: skillCatalog.length > 0,
+  });
   const attemptToolDefinitions = [
     ...(operationReadStore
       ? [
@@ -908,6 +919,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
           organizationGatewayCustomModels,
           organizationOpenRouterConnectionActive,
           organizationOpenRouterCustomModels,
+          codexModelAvailability,
         ] = await Promise.all([
           getWorkspaceConnectionModelRestrictions(
             db,
@@ -953,9 +965,11 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
             workspaceId: input.workspaceId,
             providerKind: "openrouter",
           }),
+          loadWorkspaceCodexModelAvailability(db, currentSettings, input.workspaceId),
         ]);
         return {
           selections: resolveWorkspaceModelSelection({
+            observations: codexModelAvailability,
             connectionModelRestrictions,
             settings: currentSettings,
             policy,
@@ -997,6 +1011,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       : []),
     ...createFirstPartyInteractionAttemptToolDefinitions({
       settings: runSettings,
+      ...(credentialRestriction ? { credentialRestriction } : {}),
       scope: {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -1017,7 +1032,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       ? [googleDrivePublicationTool]
       : []),
     ...codeSearchTools,
-  ];
+  ].filter((tool) => attemptToolFamilies.allowsFunctionTool(tool.modelName));
   recordTurnStartupPhase(observability, {
     phase: "tool_context_preparation",
     provider: turnExecutionPolicy.providerId,
@@ -1092,6 +1107,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
   try {
     eventing.preparedTools = await waitForTurnOperation(
       runtime.prepareTools(githubRestMcp.settings, githubRestMcp.tools, {
+        ...(credentialRestriction ? { credentialRestriction } : {}),
         mcpAccountLabels: accountRoutes.accountLabels,
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -1110,7 +1126,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         sessionAttachedRemoteMcpTargets: selectedSessionRemoteMcpTargets(
           githubRestMcp.settings,
           session.mcpServers ?? [],
-          turn.tools ?? [],
+          githubRestMcp.tools,
           localMcpServers,
         ),
         ...(deps.runMcpCredentials ? { runMcpCredentials: deps.runMcpCredentials } : {}),

package/src/activities/agent-turn/turn-context.ts

@@ -48,6 +48,7 @@ export type TurnSettleFn = (input: {
   sessionStatus: SessionStatus;
   activeTurnId: string | null;
   suppressGoalContinuation?: boolean;
+  allowanceGoalPause?: ApplySessionTurnSettlementInput["allowanceGoalPause"];
   consumeRequestedCompactionFailure?: boolean;
   runState?: ApplySessionTurnSettlementInput["runState"];
 }) => Promise<boolean>;