robotrock 1.0.0 → 1.3.0

package/dist/ai/workflow.js

@@ -75,6 +75,13 @@ var init_convex_sanitize = __esm({
   }
 });
 
+// ../core/src/utils/deployment-secret-encryption.ts
+var init_deployment_secret_encryption = __esm({
+  "../core/src/utils/deployment-secret-encryption.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/utils/safe-url.ts
 function normalizeHostname(hostname) {
   return hostname.toLowerCase().replace(/^\[|\]$/g, "");
@@ -177,6 +184,25 @@ function isBlockedHostname(hostname) {
   }
   return isBlockedIpv4(host) || isBlockedIpv6(host);
 }
+function isLoopbackHandlerUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
+}
+function isAllowedHandlerUrl(urlString) {
+  return isPublicHttpUrl(urlString) || isLoopbackHandlerUrl(urlString);
+}
 function isPublicHttpUrl(urlString) {
   let url;
   try {
@@ -192,7 +218,7 @@ function isPublicHttpUrl(urlString) {
   }
   return !isBlockedHostname(url.hostname);
 }
-var BLOCKED_HOSTNAMES, PUBLIC_HTTP_URL_ERROR;
+var BLOCKED_HOSTNAMES, PUBLIC_HTTP_URL_ERROR, HANDLER_URL_ERROR;
 var init_safe_url = __esm({
   "../core/src/utils/safe-url.ts"() {
     "use strict";
@@ -202,6 +228,7 @@ var init_safe_url = __esm({
       "metadata.goog"
     ]);
     PUBLIC_HTTP_URL_ERROR = "URL must be a public http:// or https:// address";
+    HANDLER_URL_ERROR = "Handler URL must be a public or loopback http:// or https:// address";
   }
 });
 
@@ -218,6 +245,7 @@ var init_utils = __esm({
     "use strict";
     init_cn();
     init_convex_sanitize();
+    init_deployment_secret_encryption();
     init_safe_url();
     init_task_app();
   }
@@ -301,7 +329,7 @@ function refineContextPublicUrls(data, ctx) {
     });
   }
 }
-var safeUrlSchema, jsonSchema7Schema, uiSchemaSchema, webhookHandlerSchema, triggerHandlerSchema, handlerSchema, taskActionInputSchema, taskActionSchema, uiFieldSchemaSchema, contextUiSchema, contextDataSchema, TASK_CONTEXT_FORMAT_VERSION, taskContextObjectBaseSchema, taskContextObjectSchema, taskContextSchema, assignToSchema, threadUpdateMessageSchema, threadUpdateStatuses, threadUpdateStatusSchema, threadUpdateInputSchema, taskPriorities, taskPrioritySchema, agentTelemetrySchema, createTaskBodySchema, agentChatSeedActionSchema, agentChatSeedMessageSchema, createAgentChatBodySchema, agentChatTransportBodySchema;
+var safeUrlSchema, handlerUrlSchema, jsonSchema7Schema, uiSchemaSchema, webhookHandlerSchema, triggerHandlerSchema, handlerSchema, taskActionInputSchema, taskActionSchema, uiFieldSchemaSchema, contextUiSchema, contextDataSchema, TASK_CONTEXT_FORMAT_VERSION, taskContextObjectBaseSchema, taskContextObjectSchema, taskContextSchema, assignToSchema, threadUpdateMessageSchema, threadUpdateStatuses, threadUpdateStatusSchema, threadUpdateInputSchema, taskPriorities, taskPrioritySchema, agentTelemetrySchema, createTaskBodySchema, agentChatSeedActionSchema, agentChatSeedMessageSchema, eveAgentChatTransportSchema, createAgentChatBodySchema, agentChatAuditToolBodySchema, agentChatAuditInputBodySchema, eveHitlStagedOptionSchema, agentChatStageHitlBodySchema, agentChatLinkTaskBodySchema;
 var init_task = __esm({
   "../core/src/schemas/task.ts"() {
     "use strict";
@@ -310,6 +338,9 @@ var init_task = __esm({
     safeUrlSchema = z.string().refine((url) => isPublicHttpUrl(url), {
       message: PUBLIC_HTTP_URL_ERROR
     });
+    handlerUrlSchema = z.string().refine((url) => isAllowedHandlerUrl(url), {
+      message: HANDLER_URL_ERROR
+    });
     jsonSchema7Schema = z.custom(
       (val) => typeof val === "object" && val !== null,
       { message: "Must be a valid JSON Schema object" }
@@ -319,7 +350,7 @@ var init_task = __esm({
     });
     webhookHandlerSchema = z.object({
       type: z.literal("webhook"),
-      url: safeUrlSchema,
+      url: handlerUrlSchema,
       headers: z.record(z.string(), z.string())
     });
     triggerHandlerSchema = webhookHandlerSchema.extend({
@@ -453,28 +484,82 @@ var init_task = __esm({
         action: agentChatSeedActionSchema
       }).optional()
     });
+    eveAgentChatTransportSchema = z.object({
+      kind: z.literal("eve"),
+      chatId: z.string().min(1),
+      baseUrl: z.string().url(),
+      sessionId: z.string().optional(),
+      continuationToken: z.string().optional(),
+      streamIndex: z.number().int().nonnegative().optional(),
+      isStreaming: z.boolean().optional()
+    });
     createAgentChatBodySchema = z.object({
-      /** Trigger chat agent id (task slug). Required unless `parentChatId` is set. */
+      /** Agent id (eve agent name). Required unless `parentChatId` is set. */
       agentIdentifier: z.string().min(1).optional(),
       /** Inherit tenant/connection/agent from an existing chat (agent-spawned chats). */
       parentChatId: z.string().min(1).optional(),
-      /** Convex tenantTriggerConnections id; resolved from the tenant when omitted. */
-      connectionId: z.string().min(1).optional(),
+      /** Convex tenantEveConnections id; resolved from the tenant when omitted. */
+      eveConnectionId: z.string().min(1).optional(),
       /** Source application id; groups the chat under an inbox section. */
       app: z.string().min(1).optional(),
-      assignTo: assignToSchema.optional(),
+      /** Email of the user who owns the chat. Required unless `parentChatId` is set. */
+      ownerEmail: z.string().email().optional(),
       title: z.string().min(1),
       messages: z.array(agentChatSeedMessageSchema).default([]),
       /** Provenance label stored on the session ("cron" | "agent" | ...). */
       source: z.string().min(1).optional()
     }).refine((data) => Boolean(data.agentIdentifier || data.parentChatId), {
       message: "Provide either agentIdentifier or parentChatId"
+    }).refine((data) => Boolean(data.ownerEmail || data.parentChatId), {
+      message: "Provide ownerEmail unless parentChatId is set"
     });
-    agentChatTransportBodySchema = z.object({
-      chatId: z.string().min(1),
-      publicAccessToken: z.string().min(1),
-      lastEventId: z.string().optional(),
-      isStreaming: z.boolean().optional()
+    agentChatAuditToolBodySchema = z.object({
+      eveSessionId: z.string().min(1),
+      userId: z.string().min(1),
+      toolCallId: z.string().min(1),
+      toolName: z.string().min(1),
+      input: z.record(z.string(), z.unknown()).default({}),
+      success: z.boolean(),
+      status: z.enum(["completed", "failed", "rejected"]),
+      error: z.string().optional(),
+      idempotencyKey: z.string().optional()
+    });
+    agentChatAuditInputBodySchema = z.object({
+      eveSessionId: z.string().min(1),
+      userId: z.string().min(1),
+      actionId: z.string().min(1),
+      actionTitle: z.string().optional(),
+      prompt: z.string().optional(),
+      data: z.record(z.string(), z.unknown()).optional(),
+      idempotencyKey: z.string().optional(),
+      /** Eve input request id — used to merge staged HITL metadata. */
+      requestId: z.string().optional(),
+      /** Eve tool call id — fallback lookup for staged HITL metadata. */
+      toolCallId: z.string().optional()
+    });
+    eveHitlStagedOptionSchema = z.object({
+      id: z.string(),
+      label: z.string()
+    });
+    agentChatStageHitlBodySchema = z.object({
+      eveSessionId: z.string().min(1),
+      requests: z.array(
+        z.object({
+          requestId: z.string().min(1),
+          toolCallId: z.string().min(1),
+          toolName: z.string().min(1),
+          prompt: z.string().min(1),
+          display: z.enum(["confirmation", "select", "text"]).optional(),
+          allowFreeform: z.boolean().optional(),
+          options: z.array(eveHitlStagedOptionSchema).optional(),
+          toolInput: z.record(z.string(), z.unknown()).optional()
+        })
+      )
+    });
+    agentChatLinkTaskBodySchema = z.object({
+      eveSessionId: z.string().min(1),
+      publicTaskId: z.string().min(1),
+      toolCallId: z.string().min(1)
     });
   }
 });
@@ -486,6 +571,132 @@ var init_json_schema = __esm({
   }
 });
 
+// ../core/src/schemas/tool-result-display.ts
+import { z as z2 } from "zod";
+var toolDisplayMetadataSchema, toolDisplayEnvelopeSchema;
+var init_tool_result_display = __esm({
+  "../core/src/schemas/tool-result-display.ts"() {
+    "use strict";
+    toolDisplayMetadataSchema = z2.object({
+      widget: z2.string().optional(),
+      title: z2.string().optional(),
+      description: z2.string().optional()
+    });
+    toolDisplayEnvelopeSchema = z2.object({
+      display: toolDisplayMetadataSchema.optional(),
+      data: z2.record(z2.string(), z2.unknown()),
+      ui: z2.record(
+        z2.string(),
+        z2.object({
+          "ui:widget": z2.string().optional(),
+          "ui:title": z2.string().optional(),
+          "ui:description": z2.string().optional(),
+          "ui:options": z2.record(z2.string(), z2.unknown()).optional()
+        }).passthrough()
+      ).optional()
+    });
+  }
+});
+
+// ../core/src/schemas/agent-admin.ts
+import { z as z3 } from "zod";
+var tenantRoleSchema, agentAdminUserSchema, agentAdminMemberSchema, agentAdminGroupSchema, agentAdminGroupDetailSchema, agentAdminTaskSummarySchema, inviteMemberBodySchema, updateMemberRoleBodySchema, createGroupBodySchema, updateGroupBodySchema, addGroupMemberBodySchema, listTasksQuerySchema, searchTasksQuerySchema, assignTasksResultSchema, assignTasksResponseSchema, assignTasksBodySchema;
+var init_agent_admin = __esm({
+  "../core/src/schemas/agent-admin.ts"() {
+    "use strict";
+    init_task();
+    tenantRoleSchema = z3.enum(["admin", "member"]);
+    agentAdminUserSchema = z3.object({
+      id: z3.string(),
+      email: z3.string().email(),
+      name: z3.string()
+    });
+    agentAdminMemberSchema = z3.object({
+      userId: z3.string(),
+      role: z3.string(),
+      membershipKind: z3.enum(["team", "assignee"]),
+      hasLoggedIn: z3.boolean(),
+      user: agentAdminUserSchema
+    });
+    agentAdminGroupSchema = z3.object({
+      id: z3.string(),
+      name: z3.string(),
+      slug: z3.string(),
+      description: z3.string().nullable(),
+      memberCount: z3.number().optional()
+    });
+    agentAdminGroupDetailSchema = agentAdminGroupSchema.extend({
+      members: z3.array(
+        z3.object({
+          userId: z3.string(),
+          user: agentAdminUserSchema
+        })
+      )
+    });
+    agentAdminTaskSummarySchema = z3.object({
+      id: z3.string(),
+      convexId: z3.string(),
+      status: z3.string(),
+      type: z3.string().nullable(),
+      name: z3.string().nullable(),
+      description: z3.string().nullable(),
+      validUntil: z3.number(),
+      createdAt: z3.number(),
+      threadPriority: z3.string().nullable(),
+      handledByUserId: z3.string().nullable()
+    });
+    inviteMemberBodySchema = z3.object({
+      email: z3.string().email(),
+      role: tenantRoleSchema.optional()
+    });
+    updateMemberRoleBodySchema = z3.object({
+      role: tenantRoleSchema
+    });
+    createGroupBodySchema = z3.object({
+      name: z3.string().min(1),
+      description: z3.string().optional()
+    });
+    updateGroupBodySchema = z3.object({
+      name: z3.string().min(1).optional(),
+      description: z3.string().optional()
+    });
+    addGroupMemberBodySchema = z3.object({
+      userId: z3.string().min(1).describe("Convex user id or member email.")
+    });
+    listTasksQuerySchema = z3.object({
+      statusFilter: z3.enum(["all", "open", "handled", "expired"]).optional(),
+      typeFilter: z3.string().optional(),
+      appFilter: z3.string().optional(),
+      sortField: z3.enum(["type", "date", "status", "validUntil"]).optional(),
+      sortDirection: z3.enum(["asc", "desc"]).optional(),
+      limit: z3.coerce.number().int().positive().max(100).optional(),
+      cursor: z3.string().optional()
+    });
+    searchTasksQuerySchema = z3.object({
+      q: z3.string().min(1),
+      limit: z3.coerce.number().int().positive().max(100).optional()
+    });
+    assignTasksResultSchema = z3.object({
+      taskId: z3.string(),
+      success: z3.boolean(),
+      message: z3.string().optional(),
+      name: z3.string().nullable().optional(),
+      description: z3.string().nullable().optional(),
+      type: z3.string().nullable().optional()
+    });
+    assignTasksResponseSchema = z3.object({
+      results: z3.array(assignTasksResultSchema)
+    });
+    assignTasksBodySchema = z3.object({
+      taskIds: z3.array(z3.string().min(1)).min(1).max(100),
+      assignTo: assignToSchema.refine(
+        (value) => (value.users?.length ?? 0) > 0 || (value.groups?.length ?? 0) > 0,
+        { message: "assignTo needs at least one user email or group slug." }
+      )
+    });
+  }
+});
+
 // ../core/src/schemas/index.ts
 var init_schemas = __esm({
   "../core/src/schemas/index.ts"() {
@@ -493,11 +704,13 @@ var init_schemas = __esm({
     init_task();
     init_json_schema();
     init_context_urls();
+    init_tool_result_display();
+    init_agent_admin();
   }
 });
 
 // src/schemas/index.ts
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 function normalizeTaskContextVersion2(data) {
   const { version: legacyVersion, contextVersion, ...rest } = data;
   return {
@@ -509,73 +722,73 @@ function refineContextPublicUrls2(data, ctx) {
   const error = validateContextPublicUrls(data.context);
   if (error) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z4.ZodIssueCode.custom,
       message: error,
       path: ["context"]
     });
   }
 }
-var safeUrlSchema2, jsonSchema7Schema2, uiSchemaSchema2, webhookHandlerSchema2, triggerHandlerSchema2, handlerSchema2, taskActionInputSchema2, taskActionSchema2, uiFieldSchemaSchema2, contextUiSchema2, contextDataSchema2, TASK_CONTEXT_FORMAT_VERSION2, taskContextObjectBaseSchema2, taskContextObjectSchema2, taskContextSchema2, assignToSchema2, threadUpdateMessageSchema2, threadUpdateStatuses2, threadUpdateStatusSchema2, threadUpdateInputSchema2, taskPriorities2, taskPrioritySchema2, agentTelemetrySchema2, createTaskBodySchema2, threadUpdateBodySchema;
+var handlerUrlSchema2, jsonSchema7Schema2, uiSchemaSchema2, webhookHandlerSchema2, triggerHandlerSchema2, handlerSchema2, taskActionInputSchema2, taskActionSchema2, uiFieldSchemaSchema2, contextUiSchema2, contextDataSchema2, TASK_CONTEXT_FORMAT_VERSION2, taskContextObjectBaseSchema2, taskContextObjectSchema2, taskContextSchema2, assignToSchema2, threadUpdateMessageSchema2, threadUpdateStatuses2, threadUpdateStatusSchema2, threadUpdateInputSchema2, taskPriorities2, taskPrioritySchema2, agentTelemetrySchema2, createTaskBodySchema2, threadUpdateBodySchema;
 var init_schemas2 = __esm({
   "src/schemas/index.ts"() {
     "use strict";
     init_utils();
     init_schemas();
-    safeUrlSchema2 = z2.string().refine((url) => isPublicHttpUrl(url), {
-      message: PUBLIC_HTTP_URL_ERROR
+    handlerUrlSchema2 = z4.string().refine((url) => isAllowedHandlerUrl(url), {
+      message: HANDLER_URL_ERROR
     });
-    jsonSchema7Schema2 = z2.custom(
+    jsonSchema7Schema2 = z4.custom(
       (val) => typeof val === "object" && val !== null,
       { message: "Must be a valid JSON Schema object" }
     );
-    uiSchemaSchema2 = z2.custom((val) => typeof val === "object" && val !== null, {
+    uiSchemaSchema2 = z4.custom((val) => typeof val === "object" && val !== null, {
       message: "Must be a valid UiSchema object"
     });
-    webhookHandlerSchema2 = z2.object({
-      type: z2.literal("webhook"),
-      url: safeUrlSchema2,
-      headers: z2.record(z2.string(), z2.string())
+    webhookHandlerSchema2 = z4.object({
+      type: z4.literal("webhook"),
+      url: handlerUrlSchema2,
+      headers: z4.record(z4.string(), z4.string())
     });
     triggerHandlerSchema2 = webhookHandlerSchema2.extend({
-      type: z2.literal("trigger"),
-      tokenId: z2.string().min(1)
+      type: z4.literal("trigger"),
+      tokenId: z4.string().min(1)
     });
-    handlerSchema2 = z2.discriminatedUnion("type", [webhookHandlerSchema2, triggerHandlerSchema2]);
-    taskActionInputSchema2 = z2.object({
-      id: z2.string().min(1),
-      title: z2.string().min(1),
-      description: z2.string().optional(),
+    handlerSchema2 = z4.discriminatedUnion("type", [webhookHandlerSchema2, triggerHandlerSchema2]);
+    taskActionInputSchema2 = z4.object({
+      id: z4.string().min(1),
+      title: z4.string().min(1),
+      description: z4.string().optional(),
       schema: jsonSchema7Schema2.optional(),
       ui: uiSchemaSchema2.optional(),
-      data: z2.record(z2.string(), z2.unknown()).optional()
+      data: z4.record(z4.string(), z4.unknown()).optional()
     });
     taskActionSchema2 = taskActionInputSchema2.extend({
-      handlers: z2.array(handlerSchema2).min(1).optional()
+      handlers: z4.array(handlerSchema2).min(1).optional()
     });
-    uiFieldSchemaSchema2 = z2.object({
-      "ui:widget": z2.string().optional(),
-      "ui:title": z2.string().optional(),
-      "ui:description": z2.string().optional(),
-      "ui:options": z2.record(z2.string(), z2.unknown()).optional(),
-      items: z2.lazy(() => z2.record(z2.string(), uiFieldSchemaSchema2)).optional()
+    uiFieldSchemaSchema2 = z4.object({
+      "ui:widget": z4.string().optional(),
+      "ui:title": z4.string().optional(),
+      "ui:description": z4.string().optional(),
+      "ui:options": z4.record(z4.string(), z4.unknown()).optional(),
+      items: z4.lazy(() => z4.record(z4.string(), uiFieldSchemaSchema2)).optional()
     }).passthrough();
-    contextUiSchema2 = z2.record(z2.string(), uiFieldSchemaSchema2).optional();
-    contextDataSchema2 = z2.object({
-      data: z2.record(z2.string(), z2.unknown()),
+    contextUiSchema2 = z4.record(z4.string(), uiFieldSchemaSchema2).optional();
+    contextDataSchema2 = z4.object({
+      data: z4.record(z4.string(), z4.unknown()),
       ui: contextUiSchema2
     }).optional();
     TASK_CONTEXT_FORMAT_VERSION2 = 2;
-    taskContextObjectBaseSchema2 = z2.object({
-      app: z2.string().min(1).optional(),
-      type: z2.string().min(1),
-      name: z2.string().min(1),
-      description: z2.string().optional(),
-      validUntil: z2.string().optional(),
+    taskContextObjectBaseSchema2 = z4.object({
+      app: z4.string().min(1).optional(),
+      type: z4.string().min(1),
+      name: z4.string().min(1),
+      description: z4.string().optional(),
+      validUntil: z4.string().optional(),
       context: contextDataSchema2,
-      contextVersion: z2.literal(2).optional(),
+      contextVersion: z4.literal(2).optional(),
       /** @deprecated Use `contextVersion`. Accepted on ingest only. */
-      version: z2.literal(2).optional(),
-      actions: z2.array(taskActionSchema2).min(1, "At least one action is required")
+      version: z4.literal(2).optional(),
+      actions: z4.array(taskActionSchema2).min(1, "At least one action is required")
     });
     taskContextObjectSchema2 = taskContextObjectBaseSchema2.transform(
       normalizeTaskContextVersion2
@@ -583,9 +796,9 @@ var init_schemas2 = __esm({
     taskContextSchema2 = taskContextObjectSchema2.superRefine(
       refineContextPublicUrls2
     );
-    assignToSchema2 = z2.object({
-      users: z2.array(z2.string().email()).optional(),
-      groups: z2.array(z2.string().min(1)).optional()
+    assignToSchema2 = z4.object({
+      users: z4.array(z4.string().email()).optional(),
+      groups: z4.array(z4.string().min(1)).optional()
     }).refine(
       (data) => {
         const groups = data.groups ?? [];
@@ -596,7 +809,7 @@ var init_schemas2 = __esm({
       },
       { message: 'Cannot combine "all" with other group slugs' }
     );
-    threadUpdateMessageSchema2 = z2.string().min(1).max(500);
+    threadUpdateMessageSchema2 = z4.string().min(1).max(500);
     threadUpdateStatuses2 = [
       "info",
       "queued",
@@ -606,15 +819,15 @@ var init_schemas2 = __esm({
       "failed",
       "cancelled"
     ];
-    threadUpdateStatusSchema2 = z2.enum(threadUpdateStatuses2);
-    threadUpdateInputSchema2 = z2.object({
+    threadUpdateStatusSchema2 = z4.enum(threadUpdateStatuses2);
+    threadUpdateInputSchema2 = z4.object({
       message: threadUpdateMessageSchema2,
       status: threadUpdateStatusSchema2.optional()
     });
     taskPriorities2 = ["low", "normal", "high", "urgent"];
-    taskPrioritySchema2 = z2.enum(taskPriorities2);
-    agentTelemetrySchema2 = z2.object({
-      version: z2.string().min(1)
+    taskPrioritySchema2 = z4.enum(taskPriorities2);
+    agentTelemetrySchema2 = z4.object({
+      version: z4.string().min(1)
     });
     createTaskBodySchema2 = taskContextObjectBaseSchema2.extend({
       assignTo: assignToSchema2.optional(),
@@ -622,7 +835,7 @@ var init_schemas2 = __esm({
        * Groups related tasks together. When omitted, the server generates one and
        * returns it so the caller can reuse it on later tasks in the same thread.
        */
-      threadId: z2.string().min(1).optional(),
+      threadId: z4.string().min(1).optional(),
       /**
        * Optional thread priority. When set, applies to the whole thread and
        * overwrites any previous priority. Omit on later tasks to leave unchanged.
@@ -639,87 +852,6 @@ var init_schemas2 = __esm({
   }
 });
 
-// src/approval-result.ts
-function toDiscriminatedApprovalResult(actions, task2) {
-  void actions;
-  if (!task2.handled) {
-    throw new Error("Task has no handled result");
-  }
-  return {
-    actionId: task2.handled.action.id,
-    data: task2.handled.action.data,
-    handledBy: task2.handled.handledBy,
-    handledAt: new Date(task2.handledAt ?? Date.now()),
-    taskId: task2.id
-  };
-}
-var TaskTimeoutError, TaskExpiredError;
-var init_approval_result = __esm({
-  "src/approval-result.ts"() {
-    "use strict";
-    TaskTimeoutError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "TaskTimeoutError";
-      }
-    };
-    TaskExpiredError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "TaskExpiredError";
-      }
-    };
-  }
-});
-
-// src/http.ts
-async function parseResponseBody(response) {
-  const contentType = response.headers.get("content-type") ?? "";
-  const bodyText = await response.text();
-  if (!bodyText) {
-    return null;
-  }
-  if (contentType.toLowerCase().includes("application/json")) {
-    try {
-      return JSON.parse(bodyText);
-    } catch {
-    }
-  }
-  try {
-    return JSON.parse(bodyText);
-  } catch {
-    return bodyText;
-  }
-}
-function getErrorMessage(data, fallback) {
-  if (data && typeof data === "object" && !Array.isArray(data)) {
-    const maybeMessage = data.message;
-    if (typeof maybeMessage === "string" && maybeMessage.trim()) {
-      return maybeMessage;
-    }
-  }
-  if (typeof data === "string" && data.trim()) {
-    const compact = data.replace(/\s+/g, " ").trim();
-    const snippet = compact.length > 180 ? `${compact.slice(0, 180)}...` : compact;
-    return `${fallback}. Server returned non-JSON response: ${snippet}`;
-  }
-  return fallback;
-}
-var RobotRockError;
-var init_http = __esm({
-  "src/http.ts"() {
-    "use strict";
-    RobotRockError = class extends Error {
-      constructor(message, statusCode, response) {
-        super(message);
-        this.statusCode = statusCode;
-        this.response = response;
-        this.name = "RobotRockError";
-      }
-    };
-  }
-});
-
 // ../core/src/types/task.ts
 var init_task2 = __esm({
   "../core/src/types/task.ts"() {
@@ -790,17 +922,36 @@ var init_welcome_task = __esm({
 });
 
 // ../core/src/app-url.ts
-var PRODUCTION_APP_URL, APP_SIGNUP_URL;
+function normalizeRobotRockApiBaseUrl(baseUrl) {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  if (trimmed.endsWith("/v1")) {
+    return trimmed;
+  }
+  return `${trimmed}/v1`;
+}
+function getRobotRockApiBaseUrl() {
+  const explicit = process.env.ROBOTROCK_BASE_URL?.trim() || process.env.ROBOTROCK_API_URL?.trim();
+  if (explicit) {
+    return normalizeRobotRockApiBaseUrl(explicit);
+  }
+  if (process.env.NODE_ENV === "production") {
+    return PRODUCTION_API_URL;
+  }
+  return DEV_API_URL;
+}
+var PRODUCTION_APP_URL, PRODUCTION_API_URL, DEV_API_URL, APP_SIGNUP_URL;
 var init_app_url = __esm({
   "../core/src/app-url.ts"() {
     "use strict";
     PRODUCTION_APP_URL = "https://app.robotrock.io";
+    PRODUCTION_API_URL = "https://api.robotrock.io/v1";
+    DEV_API_URL = "http://localhost:4001/v1";
     APP_SIGNUP_URL = `${PRODUCTION_APP_URL}/sign-up`;
   }
 });
 
 // ../core/src/attribution/index.ts
-import { z as z3 } from "zod";
+import { z as z5 } from "zod";
 var ATTRIBUTION_COOKIE_MAX_AGE, attributionSchema;
 var init_attribution = __esm({
   "../core/src/attribution/index.ts"() {
@@ -808,20 +959,27 @@ var init_attribution = __esm({
     init_app_url();
     init_app_url();
     ATTRIBUTION_COOKIE_MAX_AGE = 60 * 60 * 24 * 90;
-    attributionSchema = z3.object({
-      utmSource: z3.string().optional(),
-      utmMedium: z3.string().optional(),
-      utmCampaign: z3.string().optional(),
-      utmContent: z3.string().optional(),
-      utmTerm: z3.string().optional(),
-      gclid: z3.string().optional(),
-      landingUrl: z3.string().optional(),
-      referrer: z3.string().optional(),
-      capturedAt: z3.number()
+    attributionSchema = z5.object({
+      utmSource: z5.string().optional(),
+      utmMedium: z5.string().optional(),
+      utmCampaign: z5.string().optional(),
+      utmContent: z5.string().optional(),
+      utmTerm: z5.string().optional(),
+      gclid: z5.string().optional(),
+      landingUrl: z5.string().optional(),
+      referrer: z5.string().optional(),
+      capturedAt: z5.number()
     });
   }
 });
 
+// ../core/src/agent-service-auth.ts
+var init_agent_service_auth = __esm({
+  "../core/src/agent-service-auth.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/index.ts
 var init_src = __esm({
   "../core/src/index.ts"() {
@@ -835,6 +993,137 @@ var init_src = __esm({
     init_welcome_task();
     init_attribution();
     init_app_url();
+    init_agent_service_auth();
+  }
+});
+
+// src/approval-result.ts
+function toDiscriminatedApprovalResult(actions, task2) {
+  void actions;
+  if (!task2.handled) {
+    throw new Error("Task has no handled result");
+  }
+  return {
+    actionId: task2.handled.action.id,
+    data: task2.handled.action.data,
+    handledBy: task2.handled.handledBy,
+    handledAt: new Date(task2.handledAt ?? Date.now()),
+    taskId: task2.id
+  };
+}
+var TaskTimeoutError, TaskExpiredError;
+var init_approval_result = __esm({
+  "src/approval-result.ts"() {
+    "use strict";
+    TaskTimeoutError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "TaskTimeoutError";
+      }
+    };
+    TaskExpiredError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "TaskExpiredError";
+      }
+    };
+  }
+});
+
+// src/http.ts
+async function parseResponseBody(response) {
+  const contentType = response.headers.get("content-type") ?? "";
+  const bodyText = await response.text();
+  if (!bodyText) {
+    return null;
+  }
+  if (contentType.toLowerCase().includes("application/json")) {
+    try {
+      return JSON.parse(bodyText);
+    } catch {
+    }
+  }
+  try {
+    return JSON.parse(bodyText);
+  } catch {
+    return bodyText;
+  }
+}
+function getErrorMessage(data, fallback) {
+  if (data && typeof data === "object" && !Array.isArray(data)) {
+    const record = data;
+    const maybeMessage = record.message;
+    const maybeHint = record.hint;
+    if (typeof maybeMessage === "string" && maybeMessage.trim()) {
+      if (typeof maybeHint === "string" && maybeHint.trim()) {
+        return `${maybeMessage.trim()} ${maybeHint.trim()}`;
+      }
+      return maybeMessage;
+    }
+  }
+  if (typeof data === "string" && data.trim()) {
+    const compact = data.replace(/\s+/g, " ").trim();
+    const snippet = compact.length > 180 ? `${compact.slice(0, 180)}...` : compact;
+    return `${fallback}. Server returned non-JSON response: ${snippet}`;
+  }
+  return fallback;
+}
+var RobotRockError;
+var init_http = __esm({
+  "src/http.ts"() {
+    "use strict";
+    RobotRockError = class extends Error {
+      constructor(message, statusCode, response) {
+        super(message);
+        this.statusCode = statusCode;
+        this.response = response;
+        this.name = "RobotRockError";
+      }
+    };
+  }
+});
+
+// src/auth-headers.ts
+function buildRobotRockAuthHeaders(auth) {
+  if (auth.kind === "apiKey") {
+    const headers2 = {
+      "X-Api-Key": auth.apiKey
+    };
+    if (auth.actingUserId?.trim()) {
+      headers2[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+    }
+    return headers2;
+  }
+  const headers = {
+    Authorization: `Bearer ${auth.token}`,
+    "X-RobotRock-Tenant-Slug": auth.tenantSlug,
+    "X-RobotRock-Connection-Id": auth.connectionId
+  };
+  if (auth.actingUserId?.trim()) {
+    headers[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+  }
+  return headers;
+}
+function resolveRobotRockAuthConfig(overrides) {
+  if (overrides?.agentService) {
+    return {
+      kind: "agentService",
+      ...overrides.agentService
+    };
+  }
+  const apiKey = overrides?.apiKey ?? process.env.ROBOTROCK_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      "RobotRock auth is required. Set ROBOTROCK_API_KEY, ROBOTROCK_AGENT_SERVICE_TOKEN with tenant context, or pass auth when creating the client."
+    );
+  }
+  return { kind: "apiKey", apiKey };
+}
+var ROBOTROCK_ACTING_USER_ID_HEADER;
+var init_auth_headers = __esm({
+  "src/auth-headers.ts"() {
+    "use strict";
+    ROBOTROCK_ACTING_USER_ID_HEADER = "x-robotrock-acting-user-id";
   }
 });
 
@@ -842,7 +1131,7 @@ var init_src = __esm({
 function createChatsApi(config) {
   const headers = () => ({
     "Content-Type": "application/json",
-    "X-Api-Key": config.apiKey
+    ...buildRobotRockAuthHeaders(config.auth)
   });
   return {
     async create(input) {
@@ -895,6 +1184,120 @@ function createChatsApi(config) {
           data
         );
       }
+    },
+    async stageHitlRequests(input) {
+      const validation = agentChatStageHitlBodySchema.safeParse(input);
+      if (!validation.success) {
+        throw new RobotRockError(
+          `Invalid stage HITL input: ${validation.error.issues[0]?.message}`,
+          400,
+          validation.error.issues
+        );
+      }
+      const response = await fetch(`${config.baseUrl}/agent-chats/stage-hitl`, {
+        method: "POST",
+        headers: headers(),
+        body: JSON.stringify(validation.data)
+      });
+      if (!response.ok) {
+        const data = await parseResponseBody(response);
+        throw new RobotRockError(
+          getErrorMessage(data, "Failed to stage chat HITL requests"),
+          response.status,
+          data
+        );
+      }
+    },
+    async getStagedHitlRequests(eveSessionId) {
+      const trimmed = eveSessionId.trim();
+      if (!trimmed) {
+        throw new RobotRockError("eveSessionId is required", 400);
+      }
+      const url = new URL(`${config.baseUrl}/agent-chats/staged-hitl`);
+      url.searchParams.set("eveSessionId", trimmed);
+      const response = await fetch(url.toString(), {
+        method: "GET",
+        headers: headers()
+      });
+      const data = await parseResponseBody(response);
+      if (!response.ok) {
+        throw new RobotRockError(
+          getErrorMessage(data, "Failed to fetch staged chat HITL requests"),
+          response.status,
+          data
+        );
+      }
+      const requests = data.requests;
+      return Array.isArray(requests) ? requests : [];
+    },
+    async logInputSubmission(input) {
+      const validation = agentChatAuditInputBodySchema.safeParse(input);
+      if (!validation.success) {
+        throw new RobotRockError(
+          `Invalid audit input: ${validation.error.issues[0]?.message}`,
+          400,
+          validation.error.issues
+        );
+      }
+      const response = await fetch(`${config.baseUrl}/agent-chats/audit-input`, {
+        method: "POST",
+        headers: headers(),
+        body: JSON.stringify(validation.data)
+      });
+      if (!response.ok) {
+        const data = await parseResponseBody(response);
+        throw new RobotRockError(
+          getErrorMessage(data, "Failed to log chat input submission"),
+          response.status,
+          data
+        );
+      }
+    },
+    async logToolExecution(input) {
+      const validation = agentChatAuditToolBodySchema.safeParse(input);
+      if (!validation.success) {
+        throw new RobotRockError(
+          `Invalid audit tool input: ${validation.error.issues[0]?.message}`,
+          400,
+          validation.error.issues
+        );
+      }
+      const response = await fetch(`${config.baseUrl}/agent-chats/audit-tool`, {
+        method: "POST",
+        headers: headers(),
+        body: JSON.stringify(validation.data)
+      });
+      if (!response.ok) {
+        const data = await parseResponseBody(response);
+        throw new RobotRockError(
+          getErrorMessage(data, "Failed to log chat tool execution"),
+          response.status,
+          data
+        );
+      }
+    },
+    async linkTask(input) {
+      const validation = agentChatLinkTaskBodySchema.safeParse(input);
+      if (!validation.success) {
+        throw new RobotRockError(
+          `Invalid link task input: ${validation.error.issues[0]?.message}`,
+          400,
+          validation.error.issues
+        );
+      }
+      const response = await fetch(`${config.baseUrl}/agent-chats/link-task`, {
+        method: "POST",
+        headers: headers(),
+        body: JSON.stringify(validation.data)
+      });
+      if (!response.ok) {
+        const data = await parseResponseBody(response);
+        throw new RobotRockError(
+          getErrorMessage(data, "Failed to link inbox task to chat"),
+          response.status,
+          data
+        );
+      }
     }
   };
 }
@@ -903,6 +1306,7 @@ var init_chats = __esm({
     "use strict";
     init_src();
     init_http();
+    init_auth_headers();
   }
 });
 
@@ -988,14 +1392,17 @@ var init_client = __esm({
   "src/client.ts"() {
     "use strict";
     init_schemas2();
+    init_src();
     init_approval_result();
     init_http();
+    init_src();
     init_chats();
+    init_auth_headers();
     init_http();
     DEFAULT_POLL_INTERVAL_MS = 2e3;
     DEFAULT_TIMEOUT_MS = 24 * 60 * 60 * 1e3;
     RobotRock = class {
-      apiKey;
+      auth;
       baseUrl;
       app;
       agentVersion;
@@ -1013,14 +1420,17 @@ var init_client = __esm({
           );
         }
         const apiKey = config.apiKey ?? process.env.ROBOTROCK_API_KEY;
-        if (!apiKey) {
+        const agentService = config.agentService;
+        if (apiKey && agentService) {
           throw new Error(
-            "RobotRock API key is required. Set ROBOTROCK_API_KEY or pass apiKey when creating the client."
+            "RobotRock client cannot configure both apiKey and agentService."
           );
         }
-        this.apiKey = apiKey;
-        const rawBase = config.baseUrl ?? "https://api.robotrock.io/v1";
-        this.baseUrl = rawBase.replace(/\/+$/, "");
+        this.auth = resolveRobotRockAuthConfig({
+          ...apiKey ? { apiKey } : {},
+          ...agentService ? { agentService } : {}
+        });
+        this.baseUrl = config.baseUrl ?? getRobotRockApiBaseUrl();
         this.app = config.app;
         this.agentVersion = config.version ?? resolveAgentVersionFromEnv();
         this.contextVersion = config.advanced?.contextVersion ?? TASK_CONTEXT_FORMAT_VERSION2;
@@ -1030,14 +1440,23 @@ var init_client = __esm({
           create: (task2) => this.createTaskRequest(task2),
           get: (taskId) => this.getTaskById(taskId),
           cancel: (taskId) => this.cancelTaskRequest(taskId),
-          sendUpdate: (input) => this.sendThreadUpdate(input)
+          sendUpdate: (input) => this.sendThreadUpdate(input),
+          list: (input) => this.listTasksRequest(input),
+          search: (input) => this.searchTasksRequest(input)
         };
         this.chats = createChatsApi({
           baseUrl: this.baseUrl,
-          apiKey: this.apiKey,
+          auth: this.auth,
           app: this.app
         });
       }
+      authHeaders(extra) {
+        return {
+          "Content-Type": "application/json",
+          ...buildRobotRockAuthHeaders(this.auth),
+          ...extra
+        };
+      }
       async createTaskRequest(task2) {
         const normalizedTask = normalizeSendToHumanInput(task2, {
           webhook: this.webhook,
@@ -1062,13 +1481,9 @@ var init_client = __esm({
             validation.error.issues
           );
         }
-        const headers = {
-          "Content-Type": "application/json",
-          "X-Api-Key": this.apiKey
-        };
-        if (task2.idempotencyKey) {
-          headers["Idempotency-Key"] = task2.idempotencyKey;
-        }
+        const headers = this.authHeaders(
+          task2.idempotencyKey ? { "Idempotency-Key": task2.idempotencyKey } : void 0
+        );
         const response = await fetch(`${this.baseUrl}/`, {
           method: "POST",
           headers,
@@ -1161,9 +1576,7 @@ var init_client = __esm({
       async getTaskById(taskId) {
         const response = await fetch(`${this.baseUrl}/tasks/${taskId}`, {
           method: "GET",
-          headers: {
-            "X-Api-Key": this.apiKey
-          }
+          headers: this.authHeaders()
         });
         if (response.status === 404) {
           return null;
@@ -1198,10 +1611,7 @@ var init_client = __esm({
           `${this.baseUrl}/threads/${encodeURIComponent(threadId)}/updates`,
           {
             method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "X-Api-Key": this.apiKey
-            },
+            headers: this.authHeaders(),
             body: JSON.stringify(validation.data)
           }
         );
@@ -1218,9 +1628,7 @@ var init_client = __esm({
       async cancelTaskRequest(taskId) {
         const response = await fetch(`${this.baseUrl}/tasks/${taskId}/cancel`, {
           method: "POST",
-          headers: {
-            "X-Api-Key": this.apiKey
-          }
+          headers: this.authHeaders()
         });
         if (!response.ok) {
           const data = await parseResponseBody(response);
@@ -1231,28 +1639,77 @@ var init_client = __esm({
           );
         }
       }
+      async listTasksRequest(input) {
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(input ?? {})) {
+          if (value !== void 0 && value !== "") {
+            params.set(key, String(value));
+          }
+        }
+        const suffix = params.size > 0 ? `?${params.toString()}` : "";
+        const response = await fetch(`${this.baseUrl}/tasks${suffix}`, {
+          method: "GET",
+          headers: this.authHeaders()
+        });
+        const data = await parseResponseBody(response);
+        if (!response.ok) {
+          throw new RobotRockError(
+            getErrorMessage(data, "Failed to list tasks"),
+            response.status,
+            data
+          );
+        }
+        return data;
+      }
+      async searchTasksRequest(input) {
+        const params = new URLSearchParams({ q: input.q });
+        if (input.limit !== void 0) {
+          params.set("limit", String(input.limit));
+        }
+        const response = await fetch(`${this.baseUrl}/tasks/search?${params.toString()}`, {
+          method: "GET",
+          headers: this.authHeaders()
+        });
+        const data = await parseResponseBody(response);
+        if (!response.ok) {
+          throw new RobotRockError(
+            getErrorMessage(data, "Failed to search tasks"),
+            response.status,
+            data
+          );
+        }
+        return data;
+      }
     };
   }
 });
 
 // src/env.ts
 function resolveRobotRockConfig(overrides) {
+  const agentService = overrides?.agentService;
   const apiKey = overrides?.apiKey ?? process.env.ROBOTROCK_API_KEY;
-  if (!apiKey) {
+  if (agentService && apiKey) {
     throw new Error(
-      "RobotRock API key is required. Set ROBOTROCK_API_KEY or pass apiKey when creating the client."
+      "RobotRock client cannot configure both apiKey and agentService."
     );
   }
-  const baseUrl = overrides?.baseUrl ?? process.env.ROBOTROCK_BASE_URL ?? process.env.ROBOTROCK_API_URL ?? DEFAULT_BASE_URL;
+  const baseUrl = overrides?.baseUrl ?? getRobotRockApiBaseUrl();
   const app = overrides?.app ?? process.env.ROBOTROCK_APP;
+  if (agentService) {
+    return app ? { agentService, baseUrl, app } : { agentService, baseUrl };
+  }
+  if (!apiKey) {
+    throw new Error(
+      "RobotRock API key is required. Set ROBOTROCK_API_KEY or pass agentService when creating the client."
+    );
+  }
   return app ? { apiKey, baseUrl, app } : { apiKey, baseUrl };
 }
-var DEFAULT_BASE_URL;
 var init_env = __esm({
   "src/env.ts"() {
     "use strict";
     init_client();
-    DEFAULT_BASE_URL = "https://api.robotrock.io/v1";
+    init_src();
   }
 });
 
@@ -1781,7 +2238,7 @@ var init_workflow = __esm({
 });
 
 // src/ai/approve-by-human-tool-core.ts
-import { z as z4 } from "zod";
+import { z as z6 } from "zod";
 
 // src/ai/context.ts
 init_client();
@@ -1918,11 +2375,11 @@ function toHumanToolResult(result) {
 }
 
 // src/ai/approve-by-human-tool-core.ts
-var approveByHumanInputSchema = z4.object({
-  type: z4.string().optional().describe("Task type slug; defaults to ai-approval"),
-  name: z4.string().describe("Short title for the approval request"),
-  description: z4.string().describe("What needs approval and the consequences of approving or declining"),
-  contextSummary: z4.string().optional().describe("Optional markdown summary shown to the reviewer")
+var approveByHumanInputSchema = z6.object({
+  type: z6.string().optional().describe("Task type slug; defaults to ai-approval"),
+  name: z6.string().describe("Short title for the approval request"),
+  description: z6.string().describe("What needs approval and the consequences of approving or declining"),
+  contextSummary: z6.string().optional().describe("Optional markdown summary shown to the reviewer")
 });
 function resolveApproveByHumanToolConfig(clientOrContext, maybeOptions = {}) {
   const isDurable = typeof clientOrContext === "object" && clientOrContext !== null && "mode" in clientOrContext && (clientOrContext.mode === "trigger" || clientOrContext.mode === "workflow");
@@ -1964,16 +2421,16 @@ function buildApproveByHumanToolDefinition(clientOrContext, maybeOptions = {}) {
 
 // src/ai/create-send-to-human-tool-core.ts
 init_schemas2();
-import { z as z5 } from "zod";
-var sendToHumanToolInputSchema = z5.object({
-  type: z5.string().describe("Task type slug shown in the RobotRock inbox"),
-  name: z5.string().describe("Short title for the human reviewer"),
-  description: z5.string().optional().describe("What you need from the human and why you cannot proceed alone"),
-  context: z5.object({
-    data: z5.record(z5.string(), z5.unknown()).optional(),
-    ui: z5.record(z5.string(), z5.unknown()).optional()
+import { z as z7 } from "zod";
+var sendToHumanToolInputSchema = z7.object({
+  type: z7.string().describe("Task type slug shown in the RobotRock inbox"),
+  name: z7.string().describe("Short title for the human reviewer"),
+  description: z7.string().optional().describe("What you need from the human and why you cannot proceed alone"),
+  context: z7.object({
+    data: z7.record(z7.string(), z7.unknown()).optional(),
+    ui: z7.record(z7.string(), z7.unknown()).optional()
   }).optional().describe("Optional structured context for the inbox UI"),
-  validUntil: z5.string().datetime().optional().describe("Optional ISO deadline for the task"),
+  validUntil: z7.string().datetime().optional().describe("Optional ISO deadline for the task"),
   assignTo: assignToSchema2.optional().describe(
     "Assign to tenant member emails and/or group slugs; narrows who sees the task in the inbox"
   )
@@ -2019,12 +2476,12 @@ function buildSendToHumanToolDefinition(clientOrOptions, maybeOptions) {
 // src/ai/create-send-update-tool-core.ts
 init_schemas2();
 init_client();
-import { z as z6 } from "zod";
-var sendUpdateToolInputSchema = z6.object({
-  threadId: z6.string().optional().describe(
+import { z as z8 } from "zod";
+var sendUpdateToolInputSchema = z8.object({
+  threadId: z8.string().optional().describe(
     "Thread to post the update to. Use the `threadId` returned by a prior send-to-human task. Omit only when a session threadId is configured on the tool."
   ),
-  message: z6.string().describe("Short progress update (1-2 sentences) shown in the inbox status bar"),
+  message: z8.string().describe("Short progress update (1-2 sentences) shown in the inbox status bar"),
   status: threadUpdateStatusSchema2.optional().describe(
     "Lifecycle status driving the status-bar icon/color: info, queued, running, waiting, succeeded, failed, cancelled"
   )
@@ -2076,25 +2533,25 @@ function buildSendUpdateToolDefinition(clientOrOptions, maybeOptions = {}) {
 }
 
 // src/ai/request-action-input-tool-core.ts
-import { z as z7 } from "zod";
-var requestActionInputActionSchema = z7.object({
-  id: z7.string().min(1).optional().describe(
+import { z as z9 } from "zod";
+var requestActionInputActionSchema = z9.object({
+  id: z9.string().min(1).optional().describe(
     "Stable action identifier echoed in tool output (e.g. pick-blog-topic). Strongly recommended \u2014 auto-derived from title when omitted."
   ),
-  title: z7.string().min(1),
-  description: z7.string().optional(),
-  schema: z7.record(z7.string(), z7.unknown()).optional().describe("JSON Schema object for the human feedback form"),
-  ui: z7.record(z7.string(), z7.unknown()).optional().describe(
+  title: z9.string().min(1),
+  description: z9.string().optional(),
+  schema: z9.record(z9.string(), z9.unknown()).optional().describe("JSON Schema object for the human feedback form"),
+  ui: z9.record(z9.string(), z9.unknown()).optional().describe(
     'RJSF ui schema overrides (ui:widget, ui:enumNames, etc.). Use ui:widget "radio" for 2\u20136 discrete choices rendered as tappable cards.'
   ),
-  data: z7.record(z7.string(), z7.unknown()).optional().describe("Optional default form field values")
+  data: z9.record(z9.string(), z9.unknown()).optional().describe("Optional default form field values")
 });
-var requestActionInputToolOutputSchema = z7.object({
-  actionId: z7.string().min(1),
-  data: z7.record(z7.string(), z7.unknown())
+var requestActionInputToolOutputSchema = z9.object({
+  actionId: z9.string().min(1),
+  data: z9.record(z9.string(), z9.unknown())
 });
-var requestActionInputToolInputSchema = z7.object({
-  prompt: z7.string().optional().describe("Optional heading shown above the action widget in chat"),
+var requestActionInputToolInputSchema = z9.object({
+  prompt: z9.string().optional().describe("Optional heading shown above the action widget in chat"),
   action: requestActionInputActionSchema.describe(
     "Action widget config: JSON Schema form fields and optional RJSF ui overrides (same shape as RobotRock inbox actions)"
   )
@@ -2109,24 +2566,24 @@ function buildRequestActionInputToolDefinition(options = {}) {
 }
 
 // src/ai/report-status-tool-core.ts
-import { z as z8 } from "zod";
-var reportStatusPhaseSchema = z8.enum([
+import { z as z10 } from "zod";
+var reportStatusPhaseSchema = z10.enum([
   "info",
   "running",
   "waiting",
   "succeeded",
   "failed"
 ]);
-var reportStatusToolInputSchema = z8.object({
-  message: z8.string().min(1).describe(
+var reportStatusToolInputSchema = z10.object({
+  message: z10.string().min(1).describe(
     "Short progress update shown in chat (1-2 sentences). Use while researching, drafting, or waiting on external work."
   ),
   phase: reportStatusPhaseSchema.optional().describe(
     "Lifecycle phase for the status marker. Defaults to running. Use succeeded or failed when a step finishes."
   )
 });
-var reportStatusToolOutputSchema = z8.object({
-  message: z8.string().min(1),
+var reportStatusToolOutputSchema = z10.object({
+  message: z10.string().min(1),
   phase: reportStatusPhaseSchema
 });
 function normalizeReportStatusToolInput(input) {