@rosthq/cli 0.7.72 → 0.7.74

package/dist/index.js

@@ -38281,10 +38281,10 @@ var CATALOG_ENTRIES = [
     title: "Run a script (sandbox)",
     provider: "rost",
     description: "Call this to run a short program (shell/node/python) in an isolated, network-disabled microVM for pure computation \u2014 parsing, transforming, calculating, or validating data the agent already holds. The sandbox has NO credentials and NO network access; it cannot read files, call APIs, or reach the internet. Use it for compute, never to fetch or send data. Every run is metered and audited; availability is a per-account entitlement and each call is confirmed by default (arbitrary code execution).",
-    // Compute-only: the microVM produces a structured, size-capped result and has
-    // no durable or external effect, so the narrowest useful tier is `read`.
-    default_scope_tier: "read",
-    scope_tiers: ["read"],
+    // Compute-only, but still arbitrary code execution. In the capability UI this
+    // belongs to the action-capable "Read & act" posture, never read-only.
+    default_scope_tier: "draft",
+    scope_tiers: ["draft"],
     // v1 injects ZERO credentials (secret grants are DER-1585) — never a vault ref.
     credential_required: false,
     // Conservative by default (invariant #10): arbitrary code execution routes to the
@@ -38410,10 +38410,20 @@ var CATALOG_ENTRIES = [
     default_access_policy: "always_ask"
   },
   {
-    id: "web.research",
+    id: "web.search",
     title: "Web research",
     provider: "web",
-    description: "Call this to research public company and role information from the open web. Read-only; escalate paid data sources or sensitive personal data.",
+    description: "Call this to search public web sources with citations. Read-only; it uses the server-side Exa provider, never exposes provider keys, and escalates paid data sources or sensitive personal data.",
+    default_scope_tier: "read",
+    scope_tiers: ["read"],
+    credential_required: false,
+    default_access_policy: "always_allow"
+  },
+  {
+    id: "web.fetch",
+    title: "Read public web page",
+    provider: "web",
+    description: "Call this to fetch and extract text from one public HTTPS page. It validates DNS, redirects, content type, size, and private-network boundaries before reading.",
     default_scope_tier: "read",
     scope_tiers: ["read"],
     credential_required: false,
@@ -38655,7 +38665,7 @@ function accessLevelForScope(scopeTier) {
 }
 function providerRequirementFor(entry) {
   if (!entry.credential_required) {
-    return entry.provider === "rost" ? "platform_managed" : "none";
+    return entry.provider === "rost" || entry.provider === "web" ? "platform_managed" : "none";
   }
   return entry.id === "secret.broker" ? "vault_ref" : "connection";
 }
@@ -38682,7 +38692,7 @@ function enrichCatalogEntry(entry) {
     access_levels: accessLevels,
     default_access_level: accessLevelForScope(entry.default_scope_tier),
     provider_requirement: providerRequirementFor(entry),
-    cost_class: entry.id === "script.run" || entry.id === "secret.broker" ? "metered_standard" : "included",
+    cost_class: entry.id === "script.run" || entry.id === "secret.broker" ? "metered_standard" : entry.id === "web.search" || entry.id === "web.fetch" || entry.id === "browser.read" ? "metered_low" : "included",
     lane_support: ["cloud", "runner", "mcp"],
     trusted_required_metadata: trustedRequiredMetadataFor(entry)
   };
@@ -39405,6 +39415,27 @@ var agentCreateFromTemplateOutputSchema = agentSetupStateSchema.extend({
   occupancy_created: external_exports.boolean()
 }).strict();
 
+// ../../packages/protocol/src/provider-costs.ts
+var providerCostKinds = ["managed_llm", "exa", "browser", "sandbox"];
+var providerCostKindSchema = external_exports.enum(providerCostKinds);
+var keySourceSchema = external_exports.enum(["rost_managed", "tenant_byok"]);
+var atSchema = external_exports.union([external_exports.date(), external_exports.string().datetime()]).optional();
+var providerCostEntrySchema = external_exports.object({
+  kind: providerCostKindSchema,
+  effectiveFrom: external_exports.string().datetime(),
+  estimatedCents: external_exports.number().int().nonnegative(),
+  provider: external_exports.string().min(1)
+}).strict();
+var PROVIDER_COST_REGISTRY = Object.freeze([
+  { kind: "exa", provider: "exa", effectiveFrom: "2026-07-11T00:00:00.000Z", estimatedCents: 30 },
+  { kind: "exa", provider: "exa", effectiveFrom: "2026-07-15T00:00:00.000Z", estimatedCents: 35 },
+  { kind: "browser", provider: "browser", effectiveFrom: "2026-07-11T00:00:00.000Z", estimatedCents: 60 },
+  { kind: "sandbox", provider: "sandbox", effectiveFrom: "2026-07-11T00:00:00.000Z", estimatedCents: 120 }
+]);
+for (const entry of PROVIDER_COST_REGISTRY) {
+  providerCostEntrySchema.parse(entry);
+}
+
 // ../../packages/protocol/src/agent-builder.ts
 var uuidSchema4 = external_exports.string().uuid();
 var singleLineSchema = external_exports.string().trim().min(1).max(500).regex(/^[^\n\r]+$/, "Value must be a single line.");
@@ -39864,6 +39895,83 @@ var toolPolicyGetOutputSchema = external_exports.object({
   tool_policy: storedTenantToolPolicySchema
 }).strict();
 
+// ../../packages/protocol/src/web-research.ts
+var webResearchCitationSchema = external_exports.object({
+  id: external_exports.string().min(1).max(80),
+  url: external_exports.string().url(),
+  title: external_exports.string().min(1).max(300)
+}).strict();
+var webSearchInputSchema = external_exports.object({
+  query: external_exports.string().trim().min(1).max(500),
+  max_results: external_exports.number().int().min(1).max(10).default(5),
+  timeout_ms: external_exports.number().int().min(250).max(2e4).default(8e3)
+}).strict();
+var webSearchResultSchema = external_exports.object({
+  citation_id: external_exports.string().min(1).max(80),
+  title: external_exports.string().min(1).max(300),
+  url: external_exports.string().url(),
+  snippet: external_exports.string().min(1).max(1200),
+  published_at: external_exports.string().datetime().nullable()
+}).strict();
+var webSearchOutputSchema = external_exports.object({
+  ok: external_exports.literal(true),
+  provider: external_exports.literal("exa"),
+  query: external_exports.string().min(1).max(500),
+  results: external_exports.array(webSearchResultSchema).max(10),
+  citations: external_exports.array(webResearchCitationSchema).max(10),
+  cost: external_exports.object({
+    provider: external_exports.literal("exa"),
+    cost_class: external_exports.literal("metered_low"),
+    estimated_units: external_exports.number().nonnegative()
+  }).strict()
+}).strict();
+var webFetchInputSchema = external_exports.object({
+  url: external_exports.string().url().max(2048),
+  timeout_ms: external_exports.number().int().min(250).max(2e4).default(8e3),
+  max_bytes: external_exports.number().int().min(1024).max(1e6).default(25e4)
+}).strict();
+var webFetchOutputSchema = external_exports.object({
+  ok: external_exports.literal(true),
+  url: external_exports.string().url(),
+  final_url: external_exports.string().url(),
+  title: external_exports.string().max(300).nullable(),
+  text: external_exports.string().max(12e4),
+  content_type: external_exports.string().max(120),
+  bytes: external_exports.number().int().nonnegative(),
+  truncated: external_exports.boolean(),
+  provenance: external_exports.object({
+    fetched_at: external_exports.string().datetime(),
+    redirect_count: external_exports.number().int().min(0).max(5),
+    pinned_addresses: external_exports.array(external_exports.string().min(1)).min(1).max(6)
+  }).strict()
+}).strict();
+var browserReadOperationSchema = external_exports.enum(["navigate", "inspect", "screenshot", "extract_text"]);
+var browserReadInputSchema = external_exports.object({
+  url: external_exports.string().url().max(2048),
+  operation: browserReadOperationSchema.default("inspect"),
+  selector: external_exports.string().trim().min(1).max(240).optional(),
+  timeout_ms: external_exports.number().int().min(250).max(2e4).default(8e3)
+}).strict();
+var browserReadOutputSchema = external_exports.object({
+  ok: external_exports.literal(true),
+  operation: browserReadOperationSchema,
+  url: external_exports.string().url(),
+  final_url: external_exports.string().url(),
+  title: external_exports.string().max(300).nullable(),
+  text: external_exports.string().max(6e4).optional(),
+  screenshot_artifact: external_exports.object({
+    artifact_id: external_exports.string().min(1).max(160),
+    tenant_id: external_exports.string().min(1).max(120),
+    mime_type: external_exports.literal("image/png"),
+    bytes: external_exports.number().int().nonnegative()
+  }).strict().optional(),
+  provenance: external_exports.object({
+    fetched_at: external_exports.string().datetime(),
+    sandbox: external_exports.literal("ephemeral_read_only"),
+    persistent_state: external_exports.literal(false)
+  }).strict()
+}).strict();
+
 // ../../packages/protocol/src/agent-policy.ts
 var AUTONOMOUS_RISK_LEVELS = ["low", "medium", "high", "critical"];
 var autonomousRiskLevelSchema = external_exports.enum(AUTONOMOUS_RISK_LEVELS);
@@ -40587,6 +40695,54 @@ var charterSchema = charterPersistedObjectSchema.superRefine(refineAutonomousBou
 var charterDocSchema = charterDocObjectSchema.superRefine(refineAutonomousBoundaries);
 var charterDocEditsSchema = charterDocObjectSchema.omit({ payload_version: true }).partial().strict();
 
+// ../../packages/protocol/src/trusted-budget.ts
+var TRUSTED_BUDGET_FORMULA_VERSION = "trusted-budget.v1";
+var MODEL_TOKEN_PROXY = Object.freeze({
+  inputTokens: 12e3,
+  outputTokens: 3e3
+});
+var LANE_MULTIPLIERS = Object.freeze({
+  cloud: 1,
+  runner: 1.1,
+  mcp_session: 1.2
+});
+var CADENCE_MULTIPLIERS = Object.freeze({
+  daily: 0.8,
+  weekly: 1,
+  monthly: 1.25,
+  quarterly: 1.5
+});
+var CADENCE_BASE_RESERVES = Object.freeze({
+  daily: 25,
+  weekly: 50,
+  monthly: 100,
+  quarterly: 200
+});
+var TOOL_COST_HINT_CENTS = Object.freeze({
+  included: 0,
+  metered_low: 25,
+  metered_standard: 100,
+  metered_high: 250
+});
+var trustedBudgetCharterBudgetSchema = external_exports.object({
+  monthly_usd: external_exports.number().nonnegative().nullable(),
+  approval_required_over_usd: external_exports.number().nonnegative().nullable()
+}).strict();
+var trustedBudgetInputSchema = external_exports.object({
+  lane: external_exports.enum(["cloud", "runner", "mcp_session"]),
+  model: external_exports.string().trim().min(1).max(120),
+  cadence: external_exports.enum(["daily", "weekly", "monthly", "quarterly"]),
+  expected_turns: external_exports.number().int().positive().max(1e4),
+  tool_cost_hints: external_exports.array(external_exports.string().trim().min(1).max(120)).default([]),
+  charter_budget: trustedBudgetCharterBudgetSchema.optional()
+}).strict();
+var trustedBudgetSuggestionSchema = external_exports.object({
+  budget_cents: external_exports.number().int().nonnegative(),
+  money_authority_cents: external_exports.number().int().nonnegative(),
+  assumptions: external_exports.array(external_exports.string().min(1)).min(1),
+  formula_version: external_exports.literal(TRUSTED_BUDGET_FORMULA_VERSION)
+}).strict();
+
 // ../../packages/protocol/src/eos-intelligence.ts
 var uuid3 = external_exports.string().uuid();
 var frictionSeveritySchema = external_exports.enum(["low", "med", "high", "critical"]);
@@ -42293,6 +42449,15 @@ var confirmationRejectOutputSchema = external_exports.object({
   command_id: external_exports.string().min(1),
   rejected: external_exports.literal(true)
 }).strict();
+var confirmationRemintInputSchema = external_exports.object({
+  confirmation_id: external_exports.string().min(1)
+}).strict();
+var confirmationRemintOutputSchema = external_exports.object({
+  confirmation_id: external_exports.string().min(1),
+  command_id: external_exports.string().min(1),
+  reminted: external_exports.literal(true),
+  new_confirmation: pendingConfirmationSchema
+}).strict();
 var confirmationListInputSchema = external_exports.object({
   limit: external_exports.number().int().min(1).max(200).optional()
 }).strict();
@@ -43075,6 +43240,101 @@ var errorLogSupersedeOutputSchema = external_exports.object({
   resolved_at: isoDateTime3
 }).strict();
 
+// ../../packages/protocol/src/working-files.ts
+var WORKING_FILE_MAX_PATH_CHARS = 512;
+var WORKING_FILE_MAX_CONTENT_CHARS = 16384;
+var isoDateTime4 = external_exports.string().datetime({ offset: true });
+var workingFileContentTypeSchema = external_exports.enum([
+  "text/plain",
+  "text/markdown",
+  "application/json",
+  "text/csv",
+  "text/yaml",
+  "application/yaml",
+  "text/x-typescript",
+  "text/typescript",
+  "text/javascript",
+  "application/javascript"
+]);
+var workingFileStateSchema = external_exports.enum(["ephemeral", "published"]);
+var workingFileRetentionClassSchema = external_exports.enum(["ephemeral_7d", "published_90d"]);
+function normalizeWorkingFilePath(value) {
+  return value.trim().replace(/\\/g, "/");
+}
+function isSafeWorkingFilePath(value) {
+  if (value.includes("\\")) {
+    return false;
+  }
+  const normalized = normalizeWorkingFilePath(value);
+  if (normalized.length === 0 || normalized.length > WORKING_FILE_MAX_PATH_CHARS) {
+    return false;
+  }
+  if (normalized.startsWith("/") || normalized.startsWith("./") || normalized.startsWith("../")) {
+    return false;
+  }
+  if (normalized.includes("\0") || normalized.includes("//")) {
+    return false;
+  }
+  const segments = normalized.split("/");
+  return segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
+var workingFilePathSchema = external_exports.string().trim().min(1).max(WORKING_FILE_MAX_PATH_CHARS).refine(isSafeWorkingFilePath, "Working file paths must be tenant-local relative paths without traversal segments");
+var workingFileCreateInputSchema = external_exports.object({
+  path: workingFilePathSchema,
+  content_type: workingFileContentTypeSchema,
+  content: external_exports.string().min(1).max(WORKING_FILE_MAX_CONTENT_CHARS)
+}).strict();
+var workingFileReadInputSchema = external_exports.object({
+  path: workingFilePathSchema
+}).strict();
+var workingFileListInputSchema = external_exports.object({
+  state: workingFileStateSchema.optional()
+}).strict();
+var workingFilePublishInputSchema = external_exports.object({
+  path: workingFilePathSchema
+}).strict();
+var workingFilesReadToolInputSchema = external_exports.discriminatedUnion("operation", [
+  external_exports.object({
+    operation: external_exports.literal("read"),
+    path: workingFilePathSchema
+  }).strict(),
+  external_exports.object({
+    operation: external_exports.literal("list"),
+    state: workingFileStateSchema.optional()
+  }).strict()
+]);
+var workingFilesWriteToolInputSchema = external_exports.discriminatedUnion("operation", [
+  external_exports.object({
+    operation: external_exports.literal("create"),
+    path: workingFilePathSchema,
+    content_type: workingFileContentTypeSchema,
+    content: external_exports.string().min(1).max(WORKING_FILE_MAX_CONTENT_CHARS)
+  }).strict(),
+  external_exports.object({
+    operation: external_exports.literal("publish"),
+    path: workingFilePathSchema
+  }).strict()
+]);
+var workingFileSummarySchema = external_exports.object({
+  file_ref: external_exports.string().min(1),
+  path: workingFilePathSchema,
+  state: workingFileStateSchema,
+  content_type: workingFileContentTypeSchema,
+  content_chars: external_exports.number().int().nonnegative(),
+  published_ref: external_exports.string().min(1).nullable(),
+  published_at: isoDateTime4.nullable(),
+  expires_at: isoDateTime4,
+  created_at: isoDateTime4,
+  updated_at: isoDateTime4
+}).strict();
+var workingFileReadResultSchema = workingFileSummarySchema.extend({
+  content: external_exports.string(),
+  content_truncated: external_exports.boolean()
+}).strict();
+var workingFilesListOutputSchema = external_exports.object({
+  files: external_exports.array(workingFileSummarySchema)
+}).strict();
+
 // ../../packages/protocol/src/run-summary.ts
 var runSummaryOutputSchema = external_exports.object({
   summary: external_exports.string().min(1).max(140)
@@ -43082,7 +43342,7 @@ var runSummaryOutputSchema = external_exports.object({
 
 // ../../packages/protocol/src/runner-settings.ts
 var uuid8 = external_exports.string().uuid();
-var isoDateTime4 = external_exports.string().datetime({ offset: true });
+var isoDateTime5 = external_exports.string().datetime({ offset: true });
 var runnerHealthSchema = external_exports.enum(["online", "stale", "offline", "revoked", "unpaired"]);
 var runnerExecutionStateSchema = external_exports.enum([
   "ready",
@@ -43102,8 +43362,8 @@ var runnerExecutionReadinessSchema = external_exports.object({
   due_queued_work_orders: external_exports.number().int().nonnegative(),
   claimed_work_orders: external_exports.number().int().nonnegative(),
   running_work_orders: external_exports.number().int().nonnegative(),
-  recent_completed_at: isoDateTime4.nullable(),
-  recent_failed_at: isoDateTime4.nullable()
+  recent_completed_at: isoDateTime5.nullable(),
+  recent_failed_at: isoDateTime5.nullable()
 }).strict();
 var runnerSandboxPostureSchema = external_exports.enum(["guard", "strict", "off", "none", "unknown"]);
 var runnerPostureSchema = external_exports.object({
@@ -43120,10 +43380,10 @@ var runnerSummarySchema = external_exports.object({
   cli_version: external_exports.string().nullable(),
   posture: runnerPostureSchema,
   execution: runnerExecutionReadinessSchema,
-  paired_at: isoDateTime4.nullable(),
-  last_heartbeat_at: isoDateTime4.nullable(),
-  revoked_at: isoDateTime4.nullable(),
-  created_at: isoDateTime4
+  paired_at: isoDateTime5.nullable(),
+  last_heartbeat_at: isoDateTime5.nullable(),
+  revoked_at: isoDateTime5.nullable(),
+  created_at: isoDateTime5
 }).strict();
 var runnerListInputSchema = external_exports.object({
   include_revoked: external_exports.boolean().optional()
@@ -43142,7 +43402,7 @@ var runnerPairingStartOutputSchema = external_exports.object({
   pairing_session_id: uuid8,
   user_code: external_exports.string(),
   verification_uri: external_exports.string(),
-  expires_at: isoDateTime4,
+  expires_at: isoDateTime5,
   expires_in: external_exports.number().int().nonnegative()
 }).strict();
 var runnerRevokeInputSchema = external_exports.object({
@@ -43160,9 +43420,9 @@ var workOrderSummarySchema = external_exports.object({
   lane: external_exports.enum(["cloud", "runner"]),
   status: workOrderStatusSchema,
   claimed_by_runner_id: uuid8.nullable(),
-  scheduled_for: isoDateTime4,
-  grace_deadline: isoDateTime4,
-  created_at: isoDateTime4
+  scheduled_for: isoDateTime5,
+  grace_deadline: isoDateTime5,
+  created_at: isoDateTime5
 }).strict();
 var workOrderListInputSchema = external_exports.object({
   status: workOrderStatusSchema.optional(),
@@ -43175,7 +43435,7 @@ var workOrderListOutputSchema = external_exports.object({
 }).strict();
 var workOrderEnqueueInputSchema = external_exports.object({
   agent_id: uuid8,
-  scheduled_for: isoDateTime4.optional(),
+  scheduled_for: isoDateTime5.optional(),
   task_id: uuid8.optional()
 }).strict();
 var agentRunNowInputSchema = external_exports.object({
@@ -43202,8 +43462,8 @@ var runnerDiagnoseOutputSchema = external_exports.object({
   platform: external_exports.string(),
   health: runnerHealthSchema,
   capabilities: runnerCapabilityDetailSchema,
-  last_heartbeat_at: isoDateTime4.nullable(),
-  paired_at: isoDateTime4.nullable(),
+  last_heartbeat_at: isoDateTime5.nullable(),
+  paired_at: isoDateTime5.nullable(),
   revocation_state: external_exports.enum(["active", "revoked", "unpaired"]),
   repair_guidance: external_exports.array(external_exports.object({
     action: external_exports.string(),
@@ -43264,7 +43524,7 @@ var notificationErrorSummarySchema = external_exports.object({
   source: external_exports.enum(["run", "llm", "tool", "mcp", "runner", "integration", "job", "web"]).nullable(),
   seat_id: uuid8.nullable(),
   run_id: uuid8.nullable(),
-  created_at: isoDateTime4
+  created_at: isoDateTime5
 }).strict();
 var notificationListErrorsOutputSchema = external_exports.object({
   errors: external_exports.array(notificationErrorSummarySchema)
@@ -43381,7 +43641,7 @@ var integrationSummarySchema = external_exports.object({
   id: uuid8,
   provider: external_exports.string(),
   status: external_exports.enum(["connected", "error", "disconnected"]),
-  last_synced_at: isoDateTime4.nullable()
+  last_synced_at: isoDateTime5.nullable()
 }).strict();
 var settingsGetInputSchema = external_exports.object({}).strict();
 var settingsGetOutputSchema = external_exports.object({
@@ -43417,7 +43677,7 @@ var tenantRenameOutputSchema = external_exports.object({
 
 // ../../packages/protocol/src/system-health.ts
 var uuidSchema14 = external_exports.string().uuid();
-var isoDateTime5 = external_exports.string().datetime({ offset: true });
+var isoDateTime6 = external_exports.string().datetime({ offset: true });
 var systemHealthCallerKindSchema = external_exports.enum(["tenant_admin", "member", "seat_token"]);
 var systemHealthCallerSchema = external_exports.object({
   kind: systemHealthCallerKindSchema,
@@ -43507,7 +43767,7 @@ var systemHealthConnectivitySectionSchema = external_exports.object({
   failed_notification_count: external_exports.number().int().nonnegative()
 }).strict();
 var systemHealthSyncSectionSchema = external_exports.object({
-  latest_brief_at: isoDateTime5.nullable(),
+  latest_brief_at: isoDateTime6.nullable(),
   missing_latest_brief: external_exports.boolean(),
   flagged_gap_count: external_exports.number().int().nonnegative()
 }).strict();
@@ -43527,7 +43787,7 @@ var systemHealthCheckInputSchema = systemHealthInputSchema.extend({
   caller: systemHealthCallerSchema
 }).strict();
 var systemHealthOutputSchema = external_exports.object({
-  generated_at: isoDateTime5,
+  generated_at: isoDateTime6,
   scope: systemHealthScopeSchema,
   verdict: systemHealthVerdictSchema,
   top_actions: external_exports.array(systemHealthActionSchema),
@@ -45130,16 +45390,16 @@ var syncBriefSchema = external_exports.object({
 }).strict();
 
 // ../../packages/protocol/src/usage.ts
-var isoDateTime6 = external_exports.string().datetime({ offset: true });
+var isoDateTime7 = external_exports.string().datetime({ offset: true });
 var periodKeySchema = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/);
 var countSchema = external_exports.number().int().nonnegative();
 var usdSchema = external_exports.string();
 var bigCountSchema = external_exports.string();
 var usagePeriodSchema = external_exports.object({
   period: periodKeySchema,
-  period_start: isoDateTime6,
-  period_end: isoDateTime6,
-  captured_at: isoDateTime6,
+  period_start: isoDateTime7,
+  period_end: isoDateTime7,
+  captured_at: isoDateTime7,
   run_count: countSchema,
   agent_count: countSchema,
   succeeded_run_count: countSchema,
@@ -45191,7 +45451,7 @@ var usageSnapshotInputSchema = external_exports.object({
   // current month. Normalized to the first of that month server-side.
   period: external_exports.union([
     external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-    isoDateTime6
+    isoDateTime7
   ]).optional()
 }).strict();
 var usageSnapshotOutputSchema = external_exports.object({
@@ -46787,7 +47047,7 @@ There is exactly one way to give a connected tool its credential, and it is the
     order: 47,
     title: "Available tools guide",
     summary: "How to think about tool categories available to seats and what each category should be used for.",
-    version: "2026-07-13.1",
+    version: "2026-07-13.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -46825,7 +47085,7 @@ Start from the seat's responsibility, not the tool list. If a tool does not dire
 
 Skills are reusable procedures a seat can learn from; they are not tools and they never grant authority. A skill package may declare required or optional tool dependencies so setup can identify blockers before assignment. Those dependencies are checked against the discoverable \`tool.catalog\` ids, scope tiers, and provider-neutral access levels, then compared to the seat's Charter permission manifest. Missing required tools block approval; optional tools produce setup warnings. A published skill version is immutable, so later corrections create a new version instead of rewriting what a run may have used.
 
-The catalog covers both the platform verbs (status, escalation, Signal readings) and the business tools the stock-agent templates grant \u2014 accounts-payable and receivable reads, AP-inbox and collections drafts, helpdesk triage, CRM reads, and content-calendar, release-artifact, and issue drafts. Each is listed with a conservative scope tier (read for the reads, draft for the drafts, where a draft never sends), a provider-neutral access level, a provider requirement, cost class, lane support, and any Trusted-mode metadata that must be present before a standing authorization can apply. Business tools are credential-gated. Because a skill's required tool id is matched against these ids, a skill that requires one of them resolves against the catalog rather than reporting an unknown tool. Catalog membership is configuration only: it still confers no authority, and a listed id runs only once a live handler exists behind the seat's signed permission manifest, the server guard, and any required credential \u2014 the manifest and guard remain the control plane. Unknown tool ids or unsupported access levels fail closed.
+The catalog covers both the platform verbs (status, escalation, Signal readings) and the business tools the stock-agent templates grant \u2014 accounts-payable and receivable reads, AP-inbox and collections drafts, helpdesk triage, CRM reads, web search, public-page fetch, browser read, working files, script execution, content-calendar, release-artifact, and issue drafts. Each is listed with a conservative scope tier (read for the reads, draft for the drafts and action-capable internal workbench tools), a provider-neutral access level, a provider requirement, cost class, lane support, and any Trusted-mode metadata that must be present before a standing authorization can apply. Business tools are credential-gated unless they are {{brand}}-managed generic workbench tools. Because a skill's required tool id is matched against these ids, a skill that requires one of them resolves against the catalog rather than reporting an unknown tool. Catalog membership is configuration only: it still confers no authority, and a listed id runs only once a live handler exists behind the seat's signed permission manifest, the server guard, and any required credential \u2014 the manifest and guard remain the control plane. Unknown tool ids or unsupported access levels fail closed.
 
 ## How agents should request tools
 
@@ -46835,14 +47095,14 @@ Agents should explain the job, the required tool category, the minimum permissio
 
 Every tool call passes the server-side guard first: the guard checks the call against the seat's signed permission manifest and records a tool-call audit row for **every** call \u2014 allowed, denied, or escalated. Tool selection is never authorization. An explicitly declined manifest entry is enforced as denied, even when the tool exists and the client asks for it. Only an allowed call reaches its handler. A connected credential is bound into the handler for the duration of the call only; the secret never appears in the result, the audit summary, logs, or the model's context.
 
-External connectors are being rolled out provider by provider, conservatively (read and draft before send; write behind approval). A selected tool is only a permission until a live handler exists and the seat has the required credential or binding. Today the built-in execution path supports internal status reporting, the generic REST GET connector when a signed host/path allowlist and credential exist, \`slack.post_message\` for a bound Slack channel, and Google handlers for \`gmail.read\`, \`gmail.draft\`, \`sheets.read\`, and approval-held \`sheets.write\` when Google is connected. \`gmail.send\` remains held for approval and live external send stays gated on Google verification. Before that verification is complete, partner demos should show sandbox dry runs, setup previews, and approval-held examples rather than claim production Google readiness. Other provider entries remain configuration-only until their connector ships, so nothing runs silently.`
+External connectors are being rolled out provider by provider, conservatively (read and draft before send; write behind approval). A selected tool is only a permission until a live handler exists and the seat has the required credential or binding. Today the built-in execution path supports internal status reporting, the generic REST GET connector when a signed host/path allowlist and credential exist, \`slack.post_message\` for a bound Slack channel, Google handlers for \`gmail.read\`, \`gmail.draft\`, \`sheets.read\`, and approval-held \`sheets.write\` when Google is connected, plus the governed workbench tools \`web.search\`, \`web.fetch\`, \`browser.read\`, \`files.read\`, \`files.write\`, and \`script.run\`. \`web.search\` uses a server-side Exa provider and returns normalized cited results without exposing provider keys. \`web.fetch\` reads one public HTTPS page only after scheme, DNS/IP, redirect, content-type, size, and timeout checks pass. \`browser.read\` opens an ephemeral read-only public-network browser session for navigation, inspection, screenshot, or extraction; it does not submit forms, persist authenticated state, execute downloads, or expose cross-tenant artifacts. \`files.read\` and \`files.write\` operate on bounded tenant-scoped working files and published \`rost://working-files/<id>\` references; they reject traversal, cap text payloads, retain ephemeral files briefly, and never execute file contents. \`script.run\` is compute-only and network-denied by default, but arbitrary code execution is action-capable, so read-only posture does not grant it; it still requires the \`agent.script_run\` entitlement and returns size-capped output. \`gmail.send\` remains held for approval and live external send stays gated on Google verification. Before that verification is complete, partner demos should show sandbox dry runs, setup previews, and approval-held examples rather than claim production Google readiness. Other provider entries remain configuration-only until their connector ships, so nothing runs silently.`
   },
   {
     slug: "mcp-and-cli-guide",
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-13.3",
+    version: "2026-07-13.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -46943,6 +47203,10 @@ The MCP server is remote and token-backed. There is no local MCP daemon to insta
 
 AICOS MCP mode is deliberately seat-scoped. In Settings, the AICOS panel can create a token for the canonical AI Chief of Staff seat and then marks MCP selectable only while a non-revoked, unexpired AICOS seat token exists. Do not use a tenant-admin MCP token to staff or test AICOS; it should operate as its own governed seat, with the web panel remaining the readiness monitor and transcript surface.
 
+MCP clients may also expose their own native browser, search, file, or shell tools. Those native client actions are outside {{brand}} receipts, cost accounting, and audit. Treat them as ungoverned scratch work until the source is fetched or recorded through a {{brand}} MCP tool such as \`web.fetch\`, \`web.search\`, \`browser.read\`, a work-log evidence call, or another governed command. Only the {{brand}} tool call creates the permission receipt and evidence record.
+
+Managed Runner turns use a generated {{brand}} MCP configuration instead of the operator's local MCP/client config. Ordinary business-agent runner turns are MCP-only, run in a read-only sandbox, and do not receive local provider keys such as Exa or browser-provider credentials. Codex runner turns ignore user config/rules, run ephemerally, and disable native search, browser, and computer-use features; Forge developer profiles keep their separate local-code workspace behavior.
+
 ## Prerequisite: a human approver in a browser
 
 A headless agent cannot complete setup unattended. Two things always require a human, so plan to announce the handoff rather than stall silently:
@@ -48477,11 +48741,11 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-07-11.1",
+    version: "2026-07-13.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
-    relatedCommandIds: ["confirmation.approve", "confirmation.list", "confirmation.reject", "charter.approve", "agent.go_live", "credential.ingress", "mcp_token.create", "staffing.assign_user", "goal.reparent", "friction.resolve"],
+    relatedCommandIds: ["confirmation.approve", "confirmation.list", "confirmation.reject", "confirmation.remint", "charter.approve", "agent.go_live", "credential.ingress", "mcp_token.create", "staffing.assign_user", "goal.reparent", "friction.resolve"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native human-gate guidance."] },
     sources: [
       {
@@ -48540,7 +48804,7 @@ Stop before: approving a Charter, signing a manifest, connecting a tool or crede
     order: 71,
     title: "Billing and pricing guide",
     summary: "How {{brand}} packages company-wide access, Stripe billing, and governed-agent usage without per-human-seat pricing.",
-    version: "2026-07-02.5",
+    version: "2026-07-13.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing", "operating_rhythm"],
@@ -48596,6 +48860,14 @@ The first meter is billable-successful-agent-run based because the current platf
 
 Billable true-up is service-owned and runs after a period is closed. The tenant-facing \`usage.snapshot\` command is an ROI/reporting tool; an early current-period snapshot must not become, replace, or block the final billable close. The billing close records a separate \`billing_usage_true_ups\` row keyed by tenant and period with the source kind, included allowance, billable overage, status, and Stripe meter event identifier. A closed usage snapshot is preferred only when it was captured after the period ended; otherwise the service close uses a live rollup for that closed period so an early ROI snapshot cannot undercount the invoice true-up.
 
+## Launch credits and recovery access
+
+Eligible launch tenants can receive one configured launch credit for {{brand}}-managed variable costs. Managed LLM, Exa, browser, and sandbox costs are estimated before the provider call, reserved atomically against the active launch credit, and then settled to actual usage or released if the call does not complete. BYOK model calls do not draw down launch credit, but they still keep their ordinary audit and usage records.
+
+Launch-credit notifications are informational and idempotent: owners may see threshold, exhaustion, or expiry notices with recovery actions when the remaining credit drops or the credit approaches its expiry window.
+
+When an unsubscribed tenant's launch credit expires, {{brand}} enters a recovery-safe posture instead of deleting the workspace or letting agents continue spending. Billing, BYOK setup, export, cancel, and delete/recovery routes stay reachable so a human can restore or leave cleanly. Operational writes, schedules, cloud agent runs, and other cost-creating actions pause until the tenant has an active subscription or active launch credit again.
+
 ## Stripe boundary
 
 Stripe owns payment collection, payment methods, invoices, and hosted customer self-service.
@@ -49781,7 +50053,7 @@ This worked document **omits** \`unanswered_boundaries\` and \`seat_type_recomme
     order: 43,
     title: "Agent builder guide",
     summary: "The full agent setup sequence on the CLI/MCP path \u2014 seat, steward, job, boundaries, tools, credentials, model, schedule, dry-run, go-live \u2014 with the structured model config and access tiers.",
-    version: "2026-07-10.1",
+    version: "2026-07-13.1",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -49870,7 +50142,7 @@ Conservative by default: anything beyond read/draft defaults to \`always_ask\`.
 
 - **Finance clerk (AP/AR).** Tight read + draft scopes (\`ap.invoices.read\`, \`accounting.bills.draft_update\`); posting and payment escalate; measurables track drafted-on-time and discrepancies caught. Balanced model.
 - **Inbox / scheduling assistant.** \`gmail.read\` + draft + \`calendar.propose_hold\`; sends and confirmed meetings are approval-gated; sensitive messages escalate. Triage or balanced model.
-- **Research / SDR.** \`web.research\` + \`crm.contacts.draft_update\` (draft only); outreach and paid data escalate. Balanced model.
+- **Research / SDR.** \`web.search\` + \`crm.contacts.draft_update\` (draft only); outreach and paid data escalate. Balanced model.
 - **Reviewer / QA.** Read release artifacts + draft issues; release approval and production changes escalate. Complex model for judgment.
 
 ## The full JSON shape
@@ -50813,6 +51085,7 @@ var COMMAND_MANIFEST = [
   { "id": "confirmation.approve", "namespace": "confirmation", "action": "approve", "title": "Approve pending confirmation", "description": "Approve an in-flight confirmation and execute the original command as the approving human.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }, { "name": "reviewed", "flag": "reviewed", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Approve pending confirmations only when the requested durable change is clear to the human owner." },
   { "id": "confirmation.list", "namespace": "confirmation", "action": "list", "title": "List pending confirmations", "description": "List in-flight confirmations awaiting a human decision, scoped to the caller's authority (owner sees all; a member sees seats they occupy; an agent sees its own seat).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List pending confirmations awaiting a human decision before approving or rejecting them." },
   { "id": "confirmation.reject", "namespace": "confirmation", "action": "reject", "title": "Reject pending confirmation", "description": "Reject an in-flight confirmation without executing the original command.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Reject pending confirmations when authority, evidence, or human intent is unclear." },
+  { "id": "confirmation.remint", "namespace": "confirmation", "action": "remint", "title": "Re-mint an expired confirmation", "description": "Stage a fresh confirmation for the same command as an expired one, re-running the normal minting authorization checks.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Re-mint an expired confirmation into a fresh one before approving, instead of re-running the original command from scratch." },
   { "id": "credential.ingress", "namespace": "credential", "action": "ingress", "title": "Store credential", "description": "Store a secret through the vault and persist only the credential vault reference.", "requiredScope": "seat", "confirmation": "credential_flow", "exposeOverMcp": false, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "scope_description", "flag": "scope-description", "type": "string", "required": true }, { "name": "secret_name", "flag": "secret-name", "type": "string", "required": true }], "hasComplexInput": false, "secretBlocked": true, "help": "Ingress credentials only through vault-backed flows; never place raw secrets in prompts, logs, or docs." },
   { "id": "deliverable.accept", "namespace": "deliverable", "action": "accept", "title": "Accept deliverable value", "description": "Record a human-confirmed accepted value (USD) on a deliverable. Humans decide; agents cannot self-accept. Re-accepting records a correction as a new event; prior events are never mutated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "deliverable_id", "flag": "deliverable-id", "type": "string", "required": true }, { "name": "impact_value_usd", "flag": "impact-value-usd", "type": "number", "required": true }], "hasComplexInput": false, "help": "Record a human-confirmed accepted value (USD) on a deliverable; owner-only and human-gated. Humans decide \u2014 agents cannot self-accept. Re-accepting records a correction as a new event." },
   { "id": "deliverable.attach", "namespace": "deliverable", "action": "attach", "title": "Attach agent deliverable", "description": "Attach a deliverable to a source run, task, or work order for the acting seat. Source refs are validated server-side.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "run_id", "flag": "run-id", "type": "string", "required": false }, { "name": "task_id", "flag": "task-id", "type": "string", "required": false }, { "name": "work_order_id", "flag": "work-order-id", "type": "string", "required": false }, { "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["brief", "work_evidence", "artifact", "report", "other"] }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "summary", "flag": "summary", "type": "string", "required": false }, { "name": "content", "flag": "content", "type": "string", "required": false }], "hasComplexInput": true, "help": "Attach a scrubbed deliverable to a source run, task, or work order that belongs to the acting seat." },
@@ -55483,6 +55756,20 @@ var RUNNER_AICOS_TURN_TOOLS = [
   "mcp__rost__rost_aicos_turn_load_context",
   "mcp__rost__rost_get_tasks"
 ];
+var CODEX_NATIVE_TOOL_ISOLATION_CONFIG_ARGS = [
+  "--config",
+  'web_search="disabled"',
+  "--config",
+  "features.browser_use=false",
+  "--config",
+  "features.in_app_browser=false",
+  "--config",
+  "features.browser_use_external=false",
+  "--config",
+  "features.browser_use_full_cdp_access=false",
+  "--config",
+  "features.computer_use=false"
+];
 var CLAUDE_WORKSPACE_WRITE_LOCAL_TOOLS = ["Read", "Write", "Edit", "Glob", "Grep", "Bash"];
 var CLAUDE_READ_LOCAL_TOOLS = ["Read", "Glob", "Grep"];
 var READ_STUB_TIMEOUT_MS = 18e4;
@@ -56249,7 +56536,8 @@ function resolveTurnPlan(input) {
       codexSandbox: "read-only",
       outputFormat: input.kind === "turn_execution" ? "json" : "text",
       repoDir: null,
-      timeoutMs: READ_STUB_TIMEOUT_MS
+      timeoutMs: READ_STUB_TIMEOUT_MS,
+      isolateCodexNativeTools: input.kind === "work_order"
     };
   }
   const execution = input.execution;
@@ -56267,7 +56555,8 @@ function resolveTurnPlan(input) {
     // Only a Forge workspace grants a repo cwd; a needs_repo contract with no prepared
     // workspace (broker/clone failed upstream) falls back to tmpdir rather than a bad cwd.
     repoDir: execution.needs_repo ? input.repoDir : null,
-    timeoutMs: resolveExecutionTimeoutMs(execution)
+    timeoutMs: resolveExecutionTimeoutMs(execution),
+    isolateCodexNativeTools: execution.profile === "seat_work"
   };
 }
 function buildTurnCommand(input) {
@@ -56284,7 +56573,13 @@ function buildTurnCommand(input) {
         plan.codexSandbox,
         // Skip the git-repo check only when the cwd is NOT a checkout (read stub in
         // tmpdir); a prepared Forge workspace IS a repo, so drop the flag there.
-        ...plan.repoDir === null ? ["--skip-git-repo-check"] : []
+        ...plan.repoDir === null ? ["--skip-git-repo-check"] : [],
+        ...plan.isolateCodexNativeTools ? [
+          "--ignore-user-config",
+          "--ignore-rules",
+          "--ephemeral",
+          ...CODEX_NATIVE_TOOL_ISOLATION_CONFIG_ARGS
+        ] : []
       ]
     };
   }