robotrock 1.1.0 → 1.3.0

package/dist/eve/tools/index.js

@@ -1,9 +1,9 @@
 // src/eve/tools/inbox/create-task.ts
 import { defineTool } from "eve/tools";
-import { z as z4 } from "zod";
+import { z as z6 } from "zod";
 
 // src/schemas/index.ts
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 
 // ../core/src/utils/safe-url.ts
 var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
@@ -390,13 +390,27 @@ var createAgentChatBodySchema = z.object({
   eveConnectionId: z.string().min(1).optional(),
   /** Source application id; groups the chat under an inbox section. */
   app: z.string().min(1).optional(),
-  assignTo: assignToSchema.optional(),
+  /** Email of the user who owns the chat. Required unless `parentChatId` is set. */
+  ownerEmail: z.string().email().optional(),
   title: z.string().min(1),
   messages: z.array(agentChatSeedMessageSchema).default([]),
   /** Provenance label stored on the session ("cron" | "agent" | ...). */
   source: z.string().min(1).optional()
 }).refine((data) => Boolean(data.agentIdentifier || data.parentChatId), {
   message: "Provide either agentIdentifier or parentChatId"
+}).refine((data) => Boolean(data.ownerEmail || data.parentChatId), {
+  message: "Provide ownerEmail unless parentChatId is set"
+});
+var agentChatAuditToolBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  userId: z.string().min(1),
+  toolCallId: z.string().min(1),
+  toolName: z.string().min(1),
+  input: z.record(z.string(), z.unknown()).default({}),
+  success: z.boolean(),
+  status: z.enum(["completed", "failed", "rejected"]),
+  error: z.string().optional(),
+  idempotencyKey: z.string().optional()
 });
 var agentChatAuditInputBodySchema = z.object({
   eveSessionId: z.string().min(1),
@@ -436,62 +450,175 @@ var agentChatLinkTaskBodySchema = z.object({
   toolCallId: z.string().min(1)
 });
 
+// ../core/src/schemas/tool-result-display.ts
+import { z as z2 } from "zod";
+var toolDisplayMetadataSchema = z2.object({
+  widget: z2.string().optional(),
+  title: z2.string().optional(),
+  description: z2.string().optional()
+});
+var toolDisplayEnvelopeSchema = z2.object({
+  display: toolDisplayMetadataSchema.optional(),
+  data: z2.record(z2.string(), z2.unknown()),
+  ui: z2.record(
+    z2.string(),
+    z2.object({
+      "ui:widget": z2.string().optional(),
+      "ui:title": z2.string().optional(),
+      "ui:description": z2.string().optional(),
+      "ui:options": z2.record(z2.string(), z2.unknown()).optional()
+    }).passthrough()
+  ).optional()
+});
+
+// ../core/src/schemas/agent-admin.ts
+import { z as z3 } from "zod";
+var tenantRoleSchema = z3.enum(["admin", "member"]);
+var agentAdminUserSchema = z3.object({
+  id: z3.string(),
+  email: z3.string().email(),
+  name: z3.string()
+});
+var agentAdminMemberSchema = z3.object({
+  userId: z3.string(),
+  role: z3.string(),
+  membershipKind: z3.enum(["team", "assignee"]),
+  hasLoggedIn: z3.boolean(),
+  user: agentAdminUserSchema
+});
+var agentAdminGroupSchema = z3.object({
+  id: z3.string(),
+  name: z3.string(),
+  slug: z3.string(),
+  description: z3.string().nullable(),
+  memberCount: z3.number().optional()
+});
+var agentAdminGroupDetailSchema = agentAdminGroupSchema.extend({
+  members: z3.array(
+    z3.object({
+      userId: z3.string(),
+      user: agentAdminUserSchema
+    })
+  )
+});
+var agentAdminTaskSummarySchema = z3.object({
+  id: z3.string(),
+  convexId: z3.string(),
+  status: z3.string(),
+  type: z3.string().nullable(),
+  name: z3.string().nullable(),
+  description: z3.string().nullable(),
+  validUntil: z3.number(),
+  createdAt: z3.number(),
+  threadPriority: z3.string().nullable(),
+  handledByUserId: z3.string().nullable()
+});
+var inviteMemberBodySchema = z3.object({
+  email: z3.string().email(),
+  role: tenantRoleSchema.optional()
+});
+var updateMemberRoleBodySchema = z3.object({
+  role: tenantRoleSchema
+});
+var createGroupBodySchema = z3.object({
+  name: z3.string().min(1),
+  description: z3.string().optional()
+});
+var updateGroupBodySchema = z3.object({
+  name: z3.string().min(1).optional(),
+  description: z3.string().optional()
+});
+var addGroupMemberBodySchema = z3.object({
+  userId: z3.string().min(1).describe("Convex user id or member email.")
+});
+var listTasksQuerySchema = z3.object({
+  statusFilter: z3.enum(["all", "open", "handled", "expired"]).optional(),
+  typeFilter: z3.string().optional(),
+  appFilter: z3.string().optional(),
+  sortField: z3.enum(["type", "date", "status", "validUntil"]).optional(),
+  sortDirection: z3.enum(["asc", "desc"]).optional(),
+  limit: z3.coerce.number().int().positive().max(100).optional(),
+  cursor: z3.string().optional()
+});
+var searchTasksQuerySchema = z3.object({
+  q: z3.string().min(1),
+  limit: z3.coerce.number().int().positive().max(100).optional()
+});
+var assignTasksResultSchema = z3.object({
+  taskId: z3.string(),
+  success: z3.boolean(),
+  message: z3.string().optional(),
+  name: z3.string().nullable().optional(),
+  description: z3.string().nullable().optional(),
+  type: z3.string().nullable().optional()
+});
+var assignTasksResponseSchema = z3.object({
+  results: z3.array(assignTasksResultSchema)
+});
+var assignTasksBodySchema = z3.object({
+  taskIds: z3.array(z3.string().min(1)).min(1).max(100),
+  assignTo: assignToSchema.refine(
+    (value) => (value.users?.length ?? 0) > 0 || (value.groups?.length ?? 0) > 0,
+    { message: "assignTo needs at least one user email or group slug." }
+  )
+});
+
 // src/schemas/index.ts
-var handlerUrlSchema2 = z2.string().refine((url) => isAllowedHandlerUrl(url), {
+var handlerUrlSchema2 = z4.string().refine((url) => isAllowedHandlerUrl(url), {
   message: HANDLER_URL_ERROR
 });
-var jsonSchema7Schema2 = z2.custom(
+var jsonSchema7Schema2 = z4.custom(
   (val) => typeof val === "object" && val !== null,
   { message: "Must be a valid JSON Schema object" }
 );
-var uiSchemaSchema2 = z2.custom((val) => typeof val === "object" && val !== null, {
+var uiSchemaSchema2 = z4.custom((val) => typeof val === "object" && val !== null, {
   message: "Must be a valid UiSchema object"
 });
-var webhookHandlerSchema2 = z2.object({
-  type: z2.literal("webhook"),
+var webhookHandlerSchema2 = z4.object({
+  type: z4.literal("webhook"),
   url: handlerUrlSchema2,
-  headers: z2.record(z2.string(), z2.string())
+  headers: z4.record(z4.string(), z4.string())
 });
 var triggerHandlerSchema2 = webhookHandlerSchema2.extend({
-  type: z2.literal("trigger"),
-  tokenId: z2.string().min(1)
+  type: z4.literal("trigger"),
+  tokenId: z4.string().min(1)
 });
-var handlerSchema2 = z2.discriminatedUnion("type", [webhookHandlerSchema2, triggerHandlerSchema2]);
-var taskActionInputSchema2 = z2.object({
-  id: z2.string().min(1),
-  title: z2.string().min(1),
-  description: z2.string().optional(),
+var handlerSchema2 = z4.discriminatedUnion("type", [webhookHandlerSchema2, triggerHandlerSchema2]);
+var taskActionInputSchema2 = z4.object({
+  id: z4.string().min(1),
+  title: z4.string().min(1),
+  description: z4.string().optional(),
   schema: jsonSchema7Schema2.optional(),
   ui: uiSchemaSchema2.optional(),
-  data: z2.record(z2.string(), z2.unknown()).optional()
+  data: z4.record(z4.string(), z4.unknown()).optional()
 });
 var taskActionSchema2 = taskActionInputSchema2.extend({
-  handlers: z2.array(handlerSchema2).min(1).optional()
+  handlers: z4.array(handlerSchema2).min(1).optional()
 });
-var uiFieldSchemaSchema2 = z2.object({
-  "ui:widget": z2.string().optional(),
-  "ui:title": z2.string().optional(),
-  "ui:description": z2.string().optional(),
-  "ui:options": z2.record(z2.string(), z2.unknown()).optional(),
-  items: z2.lazy(() => z2.record(z2.string(), uiFieldSchemaSchema2)).optional()
+var uiFieldSchemaSchema2 = z4.object({
+  "ui:widget": z4.string().optional(),
+  "ui:title": z4.string().optional(),
+  "ui:description": z4.string().optional(),
+  "ui:options": z4.record(z4.string(), z4.unknown()).optional(),
+  items: z4.lazy(() => z4.record(z4.string(), uiFieldSchemaSchema2)).optional()
 }).passthrough();
-var contextUiSchema2 = z2.record(z2.string(), uiFieldSchemaSchema2).optional();
-var contextDataSchema2 = z2.object({
-  data: z2.record(z2.string(), z2.unknown()),
+var contextUiSchema2 = z4.record(z4.string(), uiFieldSchemaSchema2).optional();
+var contextDataSchema2 = z4.object({
+  data: z4.record(z4.string(), z4.unknown()),
   ui: contextUiSchema2
 }).optional();
 var TASK_CONTEXT_FORMAT_VERSION2 = 2;
-var taskContextObjectBaseSchema2 = z2.object({
-  app: z2.string().min(1).optional(),
-  type: z2.string().min(1),
-  name: z2.string().min(1),
-  description: z2.string().optional(),
-  validUntil: z2.string().optional(),
+var taskContextObjectBaseSchema2 = z4.object({
+  app: z4.string().min(1).optional(),
+  type: z4.string().min(1),
+  name: z4.string().min(1),
+  description: z4.string().optional(),
+  validUntil: z4.string().optional(),
   context: contextDataSchema2,
-  contextVersion: z2.literal(2).optional(),
+  contextVersion: z4.literal(2).optional(),
   /** @deprecated Use `contextVersion`. Accepted on ingest only. */
-  version: z2.literal(2).optional(),
-  actions: z2.array(taskActionSchema2).min(1, "At least one action is required")
+  version: z4.literal(2).optional(),
+  actions: z4.array(taskActionSchema2).min(1, "At least one action is required")
 });
 function normalizeTaskContextVersion2(data) {
   const { version: legacyVersion, contextVersion, ...rest } = data;
@@ -507,7 +634,7 @@ function refineContextPublicUrls2(data, ctx) {
   const error = validateContextPublicUrls(data.context);
   if (error) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z4.ZodIssueCode.custom,
       message: error,
       path: ["context"]
     });
@@ -516,9 +643,9 @@ function refineContextPublicUrls2(data, ctx) {
 var taskContextSchema2 = taskContextObjectSchema2.superRefine(
   refineContextPublicUrls2
 );
-var assignToSchema2 = z2.object({
-  users: z2.array(z2.string().email()).optional(),
-  groups: z2.array(z2.string().min(1)).optional()
+var assignToSchema2 = z4.object({
+  users: z4.array(z4.string().email()).optional(),
+  groups: z4.array(z4.string().min(1)).optional()
 }).refine(
   (data) => {
     const groups = data.groups ?? [];
@@ -529,7 +656,7 @@ var assignToSchema2 = z2.object({
   },
   { message: 'Cannot combine "all" with other group slugs' }
 );
-var threadUpdateMessageSchema2 = z2.string().min(1).max(500);
+var threadUpdateMessageSchema2 = z4.string().min(1).max(500);
 var threadUpdateStatuses2 = [
   "info",
   "queued",
@@ -539,15 +666,15 @@ var threadUpdateStatuses2 = [
   "failed",
   "cancelled"
 ];
-var threadUpdateStatusSchema2 = z2.enum(threadUpdateStatuses2);
-var threadUpdateInputSchema2 = z2.object({
+var threadUpdateStatusSchema2 = z4.enum(threadUpdateStatuses2);
+var threadUpdateInputSchema2 = z4.object({
   message: threadUpdateMessageSchema2,
   status: threadUpdateStatusSchema2.optional()
 });
 var taskPriorities2 = ["low", "normal", "high", "urgent"];
-var taskPrioritySchema2 = z2.enum(taskPriorities2);
-var agentTelemetrySchema2 = z2.object({
-  version: z2.string().min(1)
+var taskPrioritySchema2 = z4.enum(taskPriorities2);
+var agentTelemetrySchema2 = z4.object({
+  version: z4.string().min(1)
 });
 var createTaskBodySchema2 = taskContextObjectBaseSchema2.extend({
   assignTo: assignToSchema2.optional(),
@@ -555,7 +682,7 @@ var createTaskBodySchema2 = taskContextObjectBaseSchema2.extend({
    * Groups related tasks together. When omitted, the server generates one and
    * returns it so the caller can reuse it on later tasks in the same thread.
    */
-  threadId: z2.string().min(1).optional(),
+  threadId: z4.string().min(1).optional(),
   /**
    * Optional thread priority. When set, applies to the whole thread and
    * overwrites any previous priority. Omit on later tasks to leave unchanged.
@@ -570,6 +697,65 @@ var createTaskBodySchema2 = taskContextObjectBaseSchema2.extend({
 }).transform(normalizeTaskContextVersion2).superRefine(refineContextPublicUrls2);
 var threadUpdateBodySchema = threadUpdateInputSchema2;
 
+// ../core/src/handler-retry.ts
+var HANDLER_RETRY_DELAYS_MS = [
+  6e4,
+  // 1m
+  3e5,
+  // 5m
+  18e5,
+  // 30m
+  36e5,
+  // 1h
+  216e5,
+  // 6h
+  864e5,
+  // 24h
+  1728e5
+  // 48h
+];
+var HANDLER_MAX_ATTEMPTS = HANDLER_RETRY_DELAYS_MS.length + 1;
+
+// ../core/src/attribution/index.ts
+import { z as z5 } from "zod";
+
+// ../core/src/app-url.ts
+var PRODUCTION_APP_URL = "https://app.robotrock.io";
+var PRODUCTION_API_URL = "https://api.robotrock.io/v1";
+var DEV_API_URL = "http://localhost:4001/v1";
+var APP_SIGNUP_URL = `${PRODUCTION_APP_URL}/sign-up`;
+function normalizeRobotRockApiBaseUrl(baseUrl) {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  if (trimmed.endsWith("/v1")) {
+    return trimmed;
+  }
+  return `${trimmed}/v1`;
+}
+function getRobotRockApiBaseUrl() {
+  const explicit = process.env.ROBOTROCK_BASE_URL?.trim() || process.env.ROBOTROCK_API_URL?.trim();
+  if (explicit) {
+    return normalizeRobotRockApiBaseUrl(explicit);
+  }
+  if (process.env.NODE_ENV === "production") {
+    return PRODUCTION_API_URL;
+  }
+  return DEV_API_URL;
+}
+
+// ../core/src/attribution/index.ts
+var ATTRIBUTION_COOKIE_MAX_AGE = 60 * 60 * 24 * 90;
+var attributionSchema = z5.object({
+  utmSource: z5.string().optional(),
+  utmMedium: z5.string().optional(),
+  utmCampaign: z5.string().optional(),
+  utmContent: z5.string().optional(),
+  utmTerm: z5.string().optional(),
+  gclid: z5.string().optional(),
+  landingUrl: z5.string().optional(),
+  referrer: z5.string().optional(),
+  capturedAt: z5.number()
+});
+
 // src/approval-result.ts
 var TaskTimeoutError = class extends Error {
   constructor(message) {
@@ -644,77 +830,27 @@ function getErrorMessage(data, fallback) {
   return fallback;
 }
 
-// ../core/src/handler-retry.ts
-var HANDLER_RETRY_DELAYS_MS = [
-  6e4,
-  // 1m
-  3e5,
-  // 5m
-  18e5,
-  // 30m
-  36e5,
-  // 1h
-  216e5,
-  // 6h
-  864e5,
-  // 24h
-  1728e5
-  // 48h
-];
-var HANDLER_MAX_ATTEMPTS = HANDLER_RETRY_DELAYS_MS.length + 1;
-
-// ../core/src/attribution/index.ts
-import { z as z3 } from "zod";
-
-// ../core/src/app-url.ts
-var PRODUCTION_APP_URL = "https://app.robotrock.io";
-var PRODUCTION_API_URL = "https://api.robotrock.io/v1";
-var DEV_API_URL = "http://localhost:4001/v1";
-var APP_SIGNUP_URL = `${PRODUCTION_APP_URL}/sign-up`;
-function normalizeRobotRockApiBaseUrl(baseUrl) {
-  const trimmed = baseUrl.trim().replace(/\/+$/, "");
-  if (trimmed.endsWith("/v1")) {
-    return trimmed;
-  }
-  return `${trimmed}/v1`;
-}
-function getRobotRockApiBaseUrl() {
-  const explicit = process.env.ROBOTROCK_BASE_URL?.trim() || process.env.ROBOTROCK_API_URL?.trim();
-  if (explicit) {
-    return normalizeRobotRockApiBaseUrl(explicit);
-  }
-  if (process.env.NODE_ENV === "production") {
-    return PRODUCTION_API_URL;
-  }
-  return DEV_API_URL;
-}
-
-// ../core/src/attribution/index.ts
-var ATTRIBUTION_COOKIE_MAX_AGE = 60 * 60 * 24 * 90;
-var attributionSchema = z3.object({
-  utmSource: z3.string().optional(),
-  utmMedium: z3.string().optional(),
-  utmCampaign: z3.string().optional(),
-  utmContent: z3.string().optional(),
-  utmTerm: z3.string().optional(),
-  gclid: z3.string().optional(),
-  landingUrl: z3.string().optional(),
-  referrer: z3.string().optional(),
-  capturedAt: z3.number()
-});
-
 // src/auth-headers.ts
+var ROBOTROCK_ACTING_USER_ID_HEADER = "x-robotrock-acting-user-id";
 function buildRobotRockAuthHeaders(auth) {
   if (auth.kind === "apiKey") {
-    return {
+    const headers2 = {
       "X-Api-Key": auth.apiKey
     };
+    if (auth.actingUserId?.trim()) {
+      headers2[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+    }
+    return headers2;
   }
-  return {
+  const headers = {
     Authorization: `Bearer ${auth.token}`,
     "X-RobotRock-Tenant-Slug": auth.tenantSlug,
     "X-RobotRock-Connection-Id": auth.connectionId
   };
+  if (auth.actingUserId?.trim()) {
+    headers[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+  }
+  return headers;
 }
 function resolveRobotRockAuthConfig(overrides) {
   if (overrides?.agentService) {
@@ -858,6 +994,29 @@ function createChatsApi(config) {
         );
       }
     },
+    async logToolExecution(input) {
+      const validation = agentChatAuditToolBodySchema.safeParse(input);
+      if (!validation.success) {
+        throw new RobotRockError(
+          `Invalid audit tool input: ${validation.error.issues[0]?.message}`,
+          400,
+          validation.error.issues
+        );
+      }
+      const response = await fetch(`${config.baseUrl}/agent-chats/audit-tool`, {
+        method: "POST",
+        headers: headers(),
+        body: JSON.stringify(validation.data)
+      });
+      if (!response.ok) {
+        const data = await parseResponseBody(response);
+        throw new RobotRockError(
+          getErrorMessage(data, "Failed to log chat tool execution"),
+          response.status,
+          data
+        );
+      }
+    },
     async linkTask(input) {
       const validation = agentChatLinkTaskBodySchema.safeParse(input);
       if (!validation.success) {
@@ -960,7 +1119,9 @@ var RobotRock = class {
       create: (task) => this.createTaskRequest(task),
       get: (taskId) => this.getTaskById(taskId),
       cancel: (taskId) => this.cancelTaskRequest(taskId),
-      sendUpdate: (input) => this.sendThreadUpdate(input)
+      sendUpdate: (input) => this.sendThreadUpdate(input),
+      list: (input) => this.listTasksRequest(input),
+      search: (input) => this.searchTasksRequest(input)
     };
     this.chats = createChatsApi({
       baseUrl: this.baseUrl,
@@ -1157,6 +1318,47 @@ var RobotRock = class {
       );
     }
   }
+  async listTasksRequest(input) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(input ?? {})) {
+      if (value !== void 0 && value !== "") {
+        params.set(key, String(value));
+      }
+    }
+    const suffix = params.size > 0 ? `?${params.toString()}` : "";
+    const response = await fetch(`${this.baseUrl}/tasks${suffix}`, {
+      method: "GET",
+      headers: this.authHeaders()
+    });
+    const data = await parseResponseBody(response);
+    if (!response.ok) {
+      throw new RobotRockError(
+        getErrorMessage(data, "Failed to list tasks"),
+        response.status,
+        data
+      );
+    }
+    return data;
+  }
+  async searchTasksRequest(input) {
+    const params = new URLSearchParams({ q: input.q });
+    if (input.limit !== void 0) {
+      params.set("limit", String(input.limit));
+    }
+    const response = await fetch(`${this.baseUrl}/tasks/search?${params.toString()}`, {
+      method: "GET",
+      headers: this.authHeaders()
+    });
+    const data = await parseResponseBody(response);
+    if (!response.ok) {
+      throw new RobotRockError(
+        getErrorMessage(data, "Failed to search tasks"),
+        response.status,
+        data
+      );
+    }
+    return data;
+  }
 };
 function createClient(config) {
   return new RobotRock(config);
@@ -1288,6 +1490,13 @@ function requireTenantCaller(ctx) {
   }
   return caller;
 }
+function requireAdminCaller(ctx) {
+  const caller = requireTenantCaller(ctx);
+  if (!caller.isAdmin) {
+    throw new Error("Tenant admin access is required.");
+  }
+  return caller;
+}
 
 // src/eve/agent/client-from-session.ts
 var warnedMissingAuth = false;
@@ -1476,37 +1685,71 @@ async function postRobotRockLinkChatTask(ctx, input) {
   }
 }
 
+// src/eve/tool-reply-guidance.ts
+var TOOL_REPLY_GUIDANCE_FIELD = "replyGuidance";
+var WHOAMI_REPLY_GUIDANCE = "The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).";
+var MY_ACCESS_REPLY_GUIDANCE = "Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds \u2265 $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins \u2014 do not tell them to find an admin manually without offering delegation first.";
+var CREATE_INBOX_TASK_REPLY_GUIDANCE = "A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.";
+var SEARCH_PRODUCTS_REPLY_GUIDANCE = "Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).";
+var MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE = "Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).";
+var MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE = "Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.";
+var MANAGE_GROUPS_LIST_REPLY_GUIDANCE = "Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.";
+var MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE = "Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.";
+var QUERY_TASKS_LIST_REPLY_GUIDANCE = "Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).";
+var QUERY_TASKS_DETAIL_REPLY_GUIDANCE = "Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.";
+var ASSIGN_TASKS_REPLY_GUIDANCE = "Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.";
+var ADMIN_MUTATION_REPLY_GUIDANCE = "The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.";
+function withReplyGuidance(result, guidance) {
+  return {
+    ...result,
+    [TOOL_REPLY_GUIDANCE_FIELD]: guidance
+  };
+}
+
 // src/eve/tools/inbox/create-task.ts
 var CREATE_INBOX_TASK_TOOL_NAME = "create_robotrock_task";
-var actionSchema = z4.object({
-  id: z4.string().min(1).describe("Stable action id, e.g. approve or reject."),
-  title: z4.string().min(1).describe("Button label shown in the inbox."),
-  description: z4.string().min(1).optional()
+var actionSchema = z6.object({
+  id: z6.string().min(1).describe("Stable action id, e.g. approve or reject."),
+  title: z6.string().min(1).describe("Button label shown in the inbox."),
+  description: z6.string().min(1).optional()
 });
-var assignToSchema3 = z4.object({
-  users: z4.array(z4.string().email()).optional().describe("Assignee emails \u2014 only these users (plus group members) see the task."),
-  groups: z4.array(z4.string().min(1)).optional().describe('Group slugs, e.g. "finance". Only members of these groups see the task.')
+var assignToSchema3 = z6.object({
+  users: z6.array(z6.string().email()).optional().describe("Assignee emails \u2014 only these users (plus group members) see the task."),
+  groups: z6.array(z6.string().min(1)).optional().describe(
+    'Group slugs, e.g. "finance" or virtual "admins". Virtual "all" means everyone; omit assignTo for the same effect.'
+  )
 }).optional().refine(
   (value) => value === void 0 || (value.users?.length ?? 0) > 0 || (value.groups?.length ?? 0) > 0,
   { message: "assignTo needs at least one user email or group slug." }
+).refine(
+  (value) => {
+    const groups = value?.groups ?? [];
+    if (groups.includes("all") && groups.length > 1) {
+      return false;
+    }
+    return true;
+  },
+  { message: 'Cannot combine "all" with other group slugs' }
 );
-var contextSchema = z4.object({
-  data: z4.record(z4.string(), z4.unknown()).optional().describe("Structured fields shown in the inbox task detail."),
-  ui: z4.record(z4.string(), z4.unknown()).optional().describe("Optional ui:* hints keyed by context.data field name.")
+var contextSchema = z6.object({
+  data: z6.record(z6.string(), z6.unknown()).optional().describe("Structured fields shown in the inbox task detail."),
+  ui: z6.record(z6.string(), z6.unknown()).optional().describe(
+    "Optional ui:* hints keyed by context.data field name (ui:widget, ui:title, ui:options). Use currency for amounts, date for ISO timestamps, link/image for URLs. Load the robotrock skill \u2192 context-widgets reference for the full widget catalog."
+  )
 }).optional();
-var createInboxTaskInputSchema = z4.object({
-  type: z4.string().min(1).describe("Task category slug, e.g. refund-approval or budget-approval."),
-  name: z4.string().min(1).describe("Short title shown in the inbox list."),
-  description: z4.string().min(1).optional(),
-  actions: z4.array(actionSchema).min(1).describe("At least one reviewer action (approve, reject, etc.)."),
+var createInboxTaskInputSchema = z6.object({
+  type: z6.string().min(1).describe("Task category slug, e.g. refund-approval or budget-approval."),
+  name: z6.string().min(1).describe("Short title shown in the inbox list."),
+  description: z6.string().min(1).optional(),
+  actions: z6.array(actionSchema).min(1).describe("At least one reviewer action (approve, reject, etc.)."),
   assignTo: assignToSchema3.describe(
     "Limit visibility to specific users and/or groups. Omit to show the task to everyone in the tenant."
   ),
   context: contextSchema,
-  validUntilHours: z4.number().positive().optional().describe("Optional deadline in hours from now. Defaults to the tenant task TTL."),
-  priority: z4.enum(["low", "normal", "high", "urgent"]).optional(),
-  updateMessage: z4.string().min(1).optional().describe("Optional thread status update logged when the task is created."),
-  delegationReason: z4.string().min(1).optional().describe(
+  validUntilHours: z6.number().positive().optional().describe("Optional deadline in hours from now. Defaults to the tenant task TTL."),
+  priority: z6.enum(["low", "normal", "high", "urgent"]).optional(),
+  updateMessage: z6.string().min(1).optional().describe("Optional thread status update logged when the task is created."),
+  delegationReason: z6.string().min(1).optional().describe(
     "User-facing explanation of why the requester cannot self-approve and the task was routed elsewhere. Required when assignTo excludes the caller."
   )
 });
@@ -1519,7 +1762,7 @@ function defaultResolveDelegationReason(input) {
 }
 function defineCreateInboxTaskTool(options) {
   return defineTool({
-    description: "Create a RobotRock inbox task and assign it to users or groups. Does not wait for a response. Only call this after the user explicitly asked to create/send/delegate an inbox task, or after they confirmed via ask_question. Never create a task silently when the user only asked for a preview, dummy example, or explanation. Always set delegationReason when assignTo excludes the caller. For refund approvals include chargeId, amount, currency, and reason in context.data.",
+    description: "Create a RobotRock inbox task and assign it to users or groups. Does not wait for a response. Only call this after the user explicitly asked to create/send/delegate an inbox task, or after they confirmed via ask_question. Never create a task silently when the user only asked for a preview, dummy example, or explanation. Always set delegationReason when assignTo excludes the caller. For refund approvals include chargeId, amount, currency, and reason in context.data. The dashboard renders a task card \u2014 do not restate task ID, assignee, or delegation details in your reply.",
     inputSchema: createInboxTaskInputSchema,
     async execute(input, ctx) {
       const caller = requireTenantCaller(ctx);
@@ -1536,14 +1779,17 @@ function defineCreateInboxTaskTool(options) {
         publicTaskId: task.taskId,
         toolCallId: ctx.callId
       });
-      return {
-        ...task,
-        name: input.name,
-        assignedTo: input.assignTo ?? null,
-        requestedBy: caller.email,
-        delegationReason: delegationReason ?? null,
-        message: delegationReason ? `${delegationReason} This chat updates when the assignee decides.` : "Task created in RobotRock. Assignees can handle it from their inbox; this chat will update when they decide."
-      };
+      return withReplyGuidance(
+        {
+          ...task,
+          name: input.name,
+          assignedTo: input.assignTo ?? null,
+          requestedBy: caller.email,
+          delegationReason: delegationReason ?? null,
+          message: delegationReason ? `${delegationReason} This chat updates when the assignee decides.` : "Task created in RobotRock. Assignees can handle it from their inbox; this chat will update when they decide."
+        },
+        CREATE_INBOX_TASK_REPLY_GUIDANCE
+      );
     }
   });
 }
@@ -1551,9 +1797,102 @@ var createInboxTaskTool = defineCreateInboxTaskTool();
 
 // src/eve/tools/identity/my-access.ts
 import { defineTool as defineTool2 } from "eve/tools";
-import { z as z5 } from "zod";
+import { z as z7 } from "zod";
+
+// src/eve/tool-result-display.ts
+function toolDisplayResult(data, options) {
+  const display = options?.widget || options?.title || options?.description ? {
+    ...options.widget ? { widget: options.widget } : {},
+    ...options.title ? { title: options.title } : {},
+    ...options.description ? { description: options.description } : {}
+  } : void 0;
+  return {
+    ...display ? { display } : {},
+    data,
+    ...options?.ui ? { ui: options.ui } : {}
+  };
+}
+
+// src/eve/tool-display-format.ts
+function formatToolObjectResult(data, options) {
+  return withReplyGuidance(
+    toolDisplayResult(data, {
+      title: options.title,
+      description: options.description,
+      ui: options.ui
+    }),
+    options.replyGuidance
+  );
+}
+function formatToolListResult(listKey, items, options) {
+  const listFieldUi = options.itemWidget ? {
+    "ui:widget": "list",
+    items: {
+      "ui:widget": options.itemWidget,
+      ...options.itemUi ?? {}
+    }
+  } : {
+    "ui:widget": "table",
+    ...options.itemUi ? { items: options.itemUi } : {}
+  };
+  return formatToolObjectResult(
+    { [listKey]: items },
+    {
+      title: options.title,
+      ui: {
+        [listKey]: listFieldUi
+      },
+      replyGuidance: options.replyGuidance
+    }
+  );
+}
+
+// src/eve/tools/identity/format-my-access.ts
+var ACCESS_FIELD_UI = {
+  workspace: { "ui:title": "Workspace" },
+  role: { "ui:title": "Role" },
+  tenantAdmin: { "ui:title": "Tenant admin", "ui:widget": "boolean" },
+  groups: { "ui:title": "Groups" },
+  manageSettings: { "ui:title": "Manage settings", "ui:widget": "boolean" },
+  manageBilling: { "ui:title": "Manage billing", "ui:widget": "boolean" },
+  manageTeam: { "ui:title": "Manage team", "ui:widget": "boolean" },
+  manageIntegrations: {
+    "ui:title": "Manage integrations",
+    "ui:widget": "boolean"
+  },
+  email: { "ui:title": "Email" }
+};
+function formatMyAccessResult(input) {
+  return formatToolObjectResult(
+    {
+      access: {
+        workspace: input.tenantSlug,
+        role: input.tenantRole ?? "member",
+        tenantAdmin: input.isTenantAdmin,
+        groups: input.groupSlugs.join(", ") || "\u2014",
+        manageSettings: input.capabilities.manageSettings,
+        manageBilling: input.capabilities.manageBilling,
+        manageTeam: input.capabilities.manageTeam,
+        manageIntegrations: input.capabilities.manageIntegrations,
+        ...input.email ? { email: input.email } : {}
+      }
+    },
+    {
+      ui: {
+        access: {
+          "ui:widget": "access",
+          "ui:title": "Your access",
+          items: ACCESS_FIELD_UI
+        }
+      },
+      replyGuidance: MY_ACCESS_REPLY_GUIDANCE
+    }
+  );
+}
+
+// src/eve/tools/identity/my-access.ts
 var MY_ACCESS_TOOL_NAME = "get_my_access";
-var myAccessInputSchema = z5.object({});
+var myAccessInputSchema = z7.object({});
 function tenantCapabilities(isAdmin) {
   return {
     manageSettings: isAdmin,
@@ -1564,25 +1903,27 @@ function tenantCapabilities(isAdmin) {
 }
 function defineMyAccessTool() {
   return defineTool2({
-    description: "Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock.",
+    description: "Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. Results render as an access card in chat \u2014 do not restate role, groups, or capabilities in your reply.",
     inputSchema: myAccessInputSchema,
     async execute(_input, ctx) {
       const caller = tryResolveTenantCaller(ctx);
       if (!caller) {
-        return {
-          authenticated: false,
-          message: "No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy."
-        };
+        return withReplyGuidance(
+          {
+            authenticated: false,
+            message: "No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy."
+          },
+          "Explain that no user is attached to this session. Do not invent access details."
+        );
       }
-      return {
-        authenticated: true,
+      return formatMyAccessResult({
+        tenantSlug: caller.tenantSlug,
         tenantRole: caller.role,
         isTenantAdmin: caller.isAdmin,
         groupSlugs: caller.groups,
         capabilities: tenantCapabilities(caller.isAdmin),
-        email: caller.email,
-        tenantSlug: caller.tenantSlug
-      };
+        email: caller.email
+      });
     }
   });
 }
@@ -1590,38 +1931,874 @@ var myAccessTool = defineMyAccessTool();
 
 // src/eve/tools/identity/whoami.ts
 import { defineTool as defineTool3 } from "eve/tools";
-import { z as z6 } from "zod";
+import { z as z8 } from "zod";
 var WHOAMI_TOOL_NAME = "whoami";
-var whoamiInputSchema = z6.object({});
+var whoamiInputSchema = z8.object({});
 function defineWhoamiTool() {
   return defineTool3({
-    description: "Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session.",
+    description: "Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session. The dashboard renders a profile card \u2014 do not repeat name, email, workspace, role, or groups in your reply; only add context not shown in the card.",
     inputSchema: whoamiInputSchema,
     async execute(_input, ctx) {
       const caller = tryResolveTenantCaller(ctx);
       if (!caller) {
-        return {
-          authenticated: false,
-          message: "No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy."
-        };
+        return withReplyGuidance(
+          {
+            authenticated: false,
+            message: "No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy."
+          },
+          "Explain that no user is attached to this session. Do not invent identity details."
+        );
       }
-      return {
-        authenticated: true,
-        userId: caller.userId,
-        name: caller.name,
-        email: caller.email,
-        tenantSlug: caller.tenantSlug,
-        role: caller.role,
-        isAdmin: caller.isAdmin,
-        groups: caller.groups.map((slug) => ({ slug })),
-        ...caller.workosUserId ? { workosUserId: caller.workosUserId } : {},
-        sessionId: ctx.session.id
-      };
+      return withReplyGuidance(
+        {
+          authenticated: true,
+          userId: caller.userId,
+          name: caller.name,
+          email: caller.email,
+          tenantSlug: caller.tenantSlug,
+          role: caller.role,
+          isAdmin: caller.isAdmin,
+          groups: caller.groups.map((slug) => ({ slug })),
+          ...caller.workosUserId ? { workosUserId: caller.workosUserId } : {},
+          sessionId: ctx.session.id
+        },
+        WHOAMI_REPLY_GUIDANCE
+      );
     }
   });
 }
 var whoamiTool = defineWhoamiTool();
 
+// src/eve/tools/catalog/search-products.ts
+import { defineTool as defineTool4 } from "eve/tools";
+import { z as z9 } from "zod";
+var SEARCH_PRODUCTS_TOOL_NAME = "search_products";
+var searchProductsInputSchema = z9.object({
+  query: z9.string().min(1).describe("Product name or SKU to search for.")
+});
+var DEMO_PRODUCTS = [
+  {
+    id: "sku-1001",
+    name: "Wireless Keyboard",
+    price: 79.99,
+    currency: "USD",
+    inStock: true
+  },
+  {
+    id: "sku-2042",
+    name: "USB-C Hub",
+    price: 45.99,
+    currency: "USD",
+    inStock: true
+  },
+  {
+    id: "sku-3308",
+    name: "Monitor Stand",
+    price: 129.99,
+    currency: "USD",
+    inStock: false
+  }
+];
+function defineSearchProductsTool() {
+  return defineTool4({
+    description: "Search the product catalog and return matching items with rich list UI. Results render as a product list card \u2014 do not restate product names, prices, or SKUs in your reply.",
+    inputSchema: searchProductsInputSchema,
+    async execute({ query }) {
+      const normalized = query.trim().toLowerCase();
+      const items = DEMO_PRODUCTS.filter(
+        (product) => product.name.toLowerCase().includes(normalized) || product.id.toLowerCase().includes(normalized)
+      );
+      return withReplyGuidance(
+        toolDisplayResult(
+          { items: [...items] },
+          {
+            title: items.length === 1 ? "1 product" : `${items.length} products`,
+            ui: {
+              items: {
+                "ui:widget": "list",
+                "ui:title": "Results",
+                items: {
+                  "ui:widget": "productInfo"
+                }
+              }
+            }
+          }
+        ),
+        SEARCH_PRODUCTS_REPLY_GUIDANCE
+      );
+    }
+  });
+}
+var searchProductsTool = defineSearchProductsTool();
+
+// src/agent-admin.ts
+async function agentAdminFetch(config, path, init) {
+  const baseUrl = (config.baseUrl?.trim() || getRobotRockApiBaseUrl()).replace(
+    /\/+$/,
+    ""
+  );
+  const url = `${baseUrl}/agent-admin${path}`;
+  const response = await fetch(url, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      ...buildRobotRockAuthHeaders(config.auth),
+      ...init?.headers ?? {}
+    }
+  });
+  const data = await parseResponseBody(response);
+  if (!response.ok) {
+    throw new RobotRockError(
+      getErrorMessage(data, `Agent admin request failed (${response.status})`),
+      response.status,
+      data
+    );
+  }
+  return data;
+}
+function createAgentAdminApi(config) {
+  return {
+    members: {
+      list: () => agentAdminFetch(config, "/members"),
+      get: (memberRef) => agentAdminFetch(config, `/members/${encodeURIComponent(memberRef)}`),
+      invite: (body) => agentAdminFetch(config, "/members", {
+        method: "POST",
+        body: JSON.stringify(body)
+      }),
+      updateRole: (memberRef, role) => agentAdminFetch(
+        config,
+        `/members/${encodeURIComponent(memberRef)}/role`,
+        {
+          method: "PATCH",
+          body: JSON.stringify({ role })
+        }
+      ),
+      remove: (memberId) => agentAdminFetch(
+        config,
+        `/members/${encodeURIComponent(memberId)}`,
+        {
+          method: "DELETE"
+        }
+      )
+    },
+    groups: {
+      list: () => agentAdminFetch(config, "/groups"),
+      get: (groupId) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`
+      ),
+      create: (body) => agentAdminFetch(config, "/groups", {
+        method: "POST",
+        body: JSON.stringify(body)
+      }),
+      update: (groupId, body) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`,
+        {
+          method: "PATCH",
+          body: JSON.stringify(body)
+        }
+      ),
+      delete: (groupId) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`,
+        {
+          method: "DELETE"
+        }
+      ),
+      addMember: (groupRef, memberRef) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupRef)}/members`,
+        {
+          method: "POST",
+          body: JSON.stringify({ userId: memberRef })
+        }
+      ),
+      removeMember: (groupRef, memberRef) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupRef)}/members/${encodeURIComponent(memberRef)}`,
+        { method: "DELETE" }
+      )
+    },
+    tasks: {
+      list: (query) => {
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(query ?? {})) {
+          if (value !== void 0 && value !== "") {
+            params.set(key, String(value));
+          }
+        }
+        const suffix = params.size > 0 ? `?${params.toString()}` : "";
+        return agentAdminFetch(
+          config,
+          `/tasks${suffix}`
+        );
+      },
+      search: (q, limit) => {
+        const params = new URLSearchParams({ q });
+        if (limit !== void 0) {
+          params.set("limit", String(limit));
+        }
+        return agentAdminFetch(
+          config,
+          `/tasks/search?${params.toString()}`
+        );
+      },
+      get: (taskId) => agentAdminFetch(config, `/tasks/${taskId}`),
+      assign: (body) => agentAdminFetch(config, "/tasks/assign", {
+        method: "POST",
+        body: JSON.stringify(body)
+      })
+    }
+  };
+}
+function createBoundAgentAdminClient(ctx) {
+  const caller = requireTenantCaller(ctx);
+  const baseUrl = process.env.ROBOTROCK_BASE_URL?.trim();
+  const serviceToken = process.env.ROBOTROCK_AGENT_SERVICE_TOKEN?.trim();
+  if (caller.connectionId && serviceToken) {
+    return createAgentAdminApi({
+      baseUrl,
+      auth: resolveRobotRockAuthConfig({
+        agentService: {
+          token: serviceToken,
+          tenantSlug: caller.tenantSlug,
+          connectionId: caller.connectionId,
+          actingUserId: caller.userId
+        }
+      })
+    });
+  }
+  const apiKey = process.env.ROBOTROCK_API_KEY?.trim();
+  if (apiKey) {
+    return createAgentAdminApi({
+      baseUrl,
+      auth: {
+        kind: "apiKey",
+        apiKey,
+        actingUserId: caller.userId
+      }
+    });
+  }
+  throw new Error(
+    "Agent admin auth is unset. Set ROBOTROCK_AGENT_SERVICE_TOKEN for hosted multi-tenant agents, or ROBOTROCK_API_KEY for self-hosted and localhost deployments."
+  );
+}
+function requireBoundAgentAdminClient(ctx) {
+  requireAdminCaller(ctx);
+  return createBoundAgentAdminClient(ctx);
+}
+
+// src/eve/tools/admin/format-team-members-list.ts
+var MEMBER_DETAIL_UI = {
+  name: { "ui:title": "Name" },
+  email: { "ui:title": "Email" },
+  role: { "ui:title": "Role" },
+  membershipKind: { "ui:title": "Membership" }
+};
+function serializeMemberRow(member) {
+  return {
+    name: member.user.name,
+    email: member.user.email,
+    role: member.role,
+    membershipKind: member.membershipKind
+  };
+}
+function formatTeamMembersListResult(members) {
+  const countLabel = members.length === 1 ? "1 team member" : `${members.length} team members`;
+  return formatToolListResult(
+    "members",
+    members.map(serializeMemberRow),
+    {
+      title: countLabel,
+      itemWidget: "tenantMember",
+      replyGuidance: MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE
+    }
+  );
+}
+function formatTeamMemberDetailResult(member, options) {
+  return formatToolObjectResult(serializeMemberRow(member), {
+    title: options?.title ?? member.user.name,
+    ui: MEMBER_DETAIL_UI,
+    replyGuidance: MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE
+  });
+}
+
+// src/eve/tools/admin/manage-team-members.ts
+import { defineTool as defineTool5 } from "eve/tools";
+import { z as z10 } from "zod";
+var MANAGE_TEAM_MEMBERS_TOOL_NAME = "manage_team_members";
+var manageTeamMembersInputSchema = z10.object({
+  action: z10.enum(["list", "get", "invite", "update_role", "remove"]),
+  userId: z10.string().min(1).optional().describe(
+    "Convex users table id for get, update_role, and remove. Prefer email when the member list only shows email."
+  ),
+  email: z10.string().email().optional().describe(
+    "Member email for get, update_role, and remove; invitee email for invite."
+  ),
+  role: z10.enum(["admin", "member"]).optional().describe("Role for invite and update_role.")
+}).superRefine((input, ctx) => {
+  const requireField = (field, message) => {
+    if (!input[field]) {
+      ctx.addIssue({ code: "custom", message, path: [field] });
+    }
+  };
+  const requireUserIdOrEmail = (message) => {
+    if (!input.userId && !input.email) {
+      ctx.addIssue({ code: "custom", message, path: ["email"] });
+    }
+  };
+  switch (input.action) {
+    case "get":
+      requireUserIdOrEmail("userId or email is required for this action.");
+      break;
+    case "remove":
+      requireUserIdOrEmail(
+        "userId or email is required when removing a member."
+      );
+      break;
+    case "invite":
+      requireField("email", "email is required when inviting a member.");
+      break;
+    case "update_role":
+      requireUserIdOrEmail(
+        "userId or email is required when updating a role."
+      );
+      requireField("role", "role is required when updating a role.");
+      break;
+  }
+});
+function resolveMemberRef(input) {
+  return input.userId ?? input.email;
+}
+function formatMemberMutationResult(payload, title) {
+  return formatToolObjectResult(payload, {
+    title,
+    ui: {
+      success: { "ui:title": "Success", "ui:widget": "boolean" },
+      promoted: { "ui:title": "Promoted existing user", "ui:widget": "boolean" }
+    },
+    replyGuidance: ADMIN_MUTATION_REPLY_GUIDANCE
+  });
+}
+function defineManageTeamMembersTool() {
+  return defineTool5({
+    description: "Tenant-admin tool for workspace team members: list, get, invite, change role, or remove. Requires tenant admin access. Use member email from list results for get, update_role, and remove \u2014 internal ids are optional. Results render as chat UI cards \u2014 do not restate member names, emails, or roles in your reply.",
+    inputSchema: manageTeamMembersInputSchema,
+    async execute(input, ctx) {
+      const api = requireBoundAgentAdminClient(ctx);
+      try {
+        switch (input.action) {
+          case "list": {
+            const result = await api.members.list();
+            return formatTeamMembersListResult(
+              result.members
+            );
+          }
+          case "get": {
+            const result = await api.members.get(resolveMemberRef(input));
+            return formatTeamMemberDetailResult(result.member);
+          }
+          case "invite": {
+            const result = await api.members.invite({
+              email: input.email,
+              role: input.role
+            });
+            if (result.member) {
+              return formatTeamMemberDetailResult(
+                result.member,
+                { title: "Member invited" }
+              );
+            }
+            return formatMemberMutationResult(
+              result,
+              "Invitation sent"
+            );
+          }
+          case "update_role": {
+            const result = await api.members.updateRole(
+              resolveMemberRef(input),
+              input.role
+            );
+            return formatMemberMutationResult(
+              result,
+              "Member role updated"
+            );
+          }
+          case "remove": {
+            const memberId = resolveMemberRef(input);
+            const result = await api.members.remove(memberId);
+            return formatMemberMutationResult(
+              result,
+              "Member removed"
+            );
+          }
+        }
+      } catch (error) {
+        if (error instanceof RobotRockError) {
+          return {
+            ok: false,
+            status: error.statusCode,
+            message: error.message,
+            response: error.response
+          };
+        }
+        throw error;
+      }
+    }
+  });
+}
+var manageTeamMembersTool = defineManageTeamMembersTool();
+
+// src/eve/tools/admin/manage-groups.ts
+import { defineTool as defineTool6 } from "eve/tools";
+import { z as z11 } from "zod";
+
+// src/eve/tools/admin/format-groups-list.ts
+var GROUP_ITEM_UI = {
+  name: { "ui:title": "Name" },
+  slug: { "ui:title": "Slug" },
+  description: { "ui:title": "Description" },
+  memberCount: { "ui:title": "Members", "ui:widget": "number" }
+};
+function serializeGroupRow(group) {
+  return {
+    name: group.name,
+    slug: group.slug,
+    description: group.description,
+    memberCount: group.memberCount ?? null
+  };
+}
+function formatGroupsListResult(groups) {
+  const countLabel = groups.length === 1 ? "1 group" : `${groups.length} groups`;
+  return formatToolListResult(
+    "groups",
+    groups.map(serializeGroupRow),
+    {
+      title: countLabel,
+      itemWidget: "tenantGroup",
+      replyGuidance: MANAGE_GROUPS_LIST_REPLY_GUIDANCE
+    }
+  );
+}
+function formatGroupDetailResult(group) {
+  return formatToolObjectResult(
+    {
+      name: group.name,
+      slug: group.slug,
+      description: group.description,
+      members: group.members.map((member) => ({
+        name: member.user.name,
+        email: member.user.email
+      }))
+    },
+    {
+      title: group.name,
+      ui: {
+        name: { "ui:title": "Name" },
+        slug: { "ui:title": "Slug" },
+        description: { "ui:title": "Description" },
+        members: {
+          "ui:widget": "list",
+          "ui:title": "Members",
+          items: {
+            name: { "ui:title": "Name" },
+            email: { "ui:title": "Email" }
+          }
+        }
+      },
+      replyGuidance: MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE
+    }
+  );
+}
+function formatGroupSummaryResult(group) {
+  return formatToolObjectResult(serializeGroupRow(group), {
+    title: group.name,
+    ui: GROUP_ITEM_UI,
+    replyGuidance: MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE
+  });
+}
+
+// src/eve/tools/admin/manage-groups.ts
+var MANAGE_GROUPS_TOOL_NAME = "manage_groups";
+var manageGroupsInputSchema = z11.object({
+  action: z11.enum([
+    "list",
+    "get",
+    "create",
+    "update",
+    "delete",
+    "add_member",
+    "remove_member"
+  ]),
+  groupId: z11.string().min(1).optional().describe(
+    "Convex group id for get, update, delete, and membership actions. Prefer slug when the group list only shows slug."
+  ),
+  slug: z11.string().min(1).optional().describe(
+    "Group slug (e.g. finance) for get, update, delete, and membership actions."
+  ),
+  userId: z11.string().min(1).optional().describe(
+    "User id for add_member and remove_member. Prefer email when the member list only shows email."
+  ),
+  email: z11.string().email().optional().describe("Member email for add_member and remove_member."),
+  name: z11.string().min(1).optional().describe("Group name for create and update."),
+  description: z11.string().optional().describe("Group description for create and update.")
+}).superRefine((input, ctx) => {
+  const requireField = (field, message) => {
+    if (!input[field]) {
+      ctx.addIssue({ code: "custom", message, path: [field] });
+    }
+  };
+  const requireGroupIdOrSlug = (message) => {
+    if (!input.groupId && !input.slug) {
+      ctx.addIssue({ code: "custom", message, path: ["slug"] });
+    }
+  };
+  const requireUserIdOrEmail = (message) => {
+    if (!input.userId && !input.email) {
+      ctx.addIssue({ code: "custom", message, path: ["email"] });
+    }
+  };
+  switch (input.action) {
+    case "get":
+    case "delete":
+      requireGroupIdOrSlug(
+        "groupId or slug is required for this action."
+      );
+      break;
+    case "create":
+      requireField("name", "name is required when creating a group.");
+      break;
+    case "update":
+      requireGroupIdOrSlug("groupId or slug is required for update.");
+      break;
+    case "add_member":
+    case "remove_member":
+      requireGroupIdOrSlug(
+        "groupId or slug is required for membership changes."
+      );
+      requireUserIdOrEmail(
+        "userId or email is required for membership changes."
+      );
+      break;
+  }
+});
+function formatGroupMutationResult(payload, title) {
+  return formatToolObjectResult(payload, {
+    title,
+    replyGuidance: ADMIN_MUTATION_REPLY_GUIDANCE
+  });
+}
+function resolveGroupRef(input) {
+  return input.groupId ?? input.slug;
+}
+function resolveMemberRef2(input) {
+  return input.userId ?? input.email;
+}
+function defineManageGroupsTool() {
+  return defineTool6({
+    description: "Tenant-admin tool for workspace groups: list, get, create, update, delete, and manage group membership. Requires tenant admin access. Use group slug (e.g. finance) from list results for get and membership actions \u2014 internal ids are optional. Use member email for add_member and remove_member when user ids are unknown. Results render as chat UI cards \u2014 do not restate group or member fields in your reply.",
+    inputSchema: manageGroupsInputSchema,
+    async execute(input, ctx) {
+      const api = requireBoundAgentAdminClient(ctx);
+      try {
+        switch (input.action) {
+          case "list": {
+            const result = await api.groups.list();
+            return formatGroupsListResult(result.groups);
+          }
+          case "get": {
+            const result = await api.groups.get(resolveGroupRef(input));
+            return formatGroupDetailResult(result.group);
+          }
+          case "create": {
+            const result = await api.groups.create({
+              name: input.name,
+              description: input.description
+            });
+            return formatGroupSummaryResult(result.group);
+          }
+          case "update": {
+            const result = await api.groups.update(resolveGroupRef(input), {
+              name: input.name,
+              description: input.description
+            });
+            return formatGroupSummaryResult(result.group);
+          }
+          case "delete": {
+            const result = await api.groups.delete(resolveGroupRef(input));
+            return formatGroupMutationResult(
+              result,
+              "Group deleted"
+            );
+          }
+          case "add_member": {
+            const result = await api.groups.addMember(
+              resolveGroupRef(input),
+              resolveMemberRef2(input)
+            );
+            return formatGroupMutationResult(
+              result,
+              "Group member added"
+            );
+          }
+          case "remove_member": {
+            const result = await api.groups.removeMember(
+              resolveGroupRef(input),
+              resolveMemberRef2(input)
+            );
+            return formatGroupMutationResult(
+              result,
+              "Group member removed"
+            );
+          }
+        }
+      } catch (error) {
+        if (error instanceof RobotRockError) {
+          return {
+            ok: false,
+            status: error.statusCode,
+            message: error.message,
+            response: error.response
+          };
+        }
+        throw error;
+      }
+    }
+  });
+}
+var manageGroupsTool = defineManageGroupsTool();
+
+// src/eve/tools/admin/query-tasks.ts
+import { defineTool as defineTool7 } from "eve/tools";
+import { z as z12 } from "zod";
+
+// src/eve/tools/admin/format-tasks-list.ts
+function resolveTaskCardLabel(task) {
+  return task.name?.trim() || task.description?.trim() || task.type?.trim() || task.id?.trim() || "Untitled task";
+}
+function formatTasksListResult(items, options) {
+  const title = options?.title ?? (items.length === 1 ? "1 task" : `${items.length} tasks`);
+  const result = formatToolListResult(
+    "items",
+    items.map((task) => ({
+      id: task.id,
+      name: resolveTaskCardLabel(task),
+      status: task.status,
+      type: task.type,
+      description: task.description
+    })),
+    {
+      title,
+      itemWidget: "tenantTask",
+      replyGuidance: QUERY_TASKS_LIST_REPLY_GUIDANCE
+    }
+  );
+  if (options?.nextCursor) {
+    return {
+      ...result,
+      data: {
+        ...result.data,
+        nextCursor: options.nextCursor
+      },
+      display: {
+        ...result.display,
+        description: "More tasks available \u2014 pass nextCursor to list again."
+      }
+    };
+  }
+  return result;
+}
+function formatTaskSearchResult(items, total) {
+  return formatTasksListResult(items, {
+    title: total === 1 ? "1 matching task" : `${total} matching tasks`
+  });
+}
+function formatTaskDetailResult(task) {
+  const title = resolveTaskCardLabel({
+    name: typeof task.name === "string" ? task.name : null,
+    description: typeof task.description === "string" ? task.description : null,
+    type: typeof task.type === "string" ? task.type : null,
+    id: typeof task.id === "string" ? task.id : null
+  });
+  return formatToolObjectResult(
+    {
+      id: task.id ?? null,
+      status: task.status ?? null,
+      type: task.type ?? null,
+      name: task.name ?? null,
+      description: task.description ?? null,
+      validUntil: task.validUntil ?? null,
+      createdAt: task.createdAt ?? null
+    },
+    {
+      title,
+      ui: {
+        id: { "ui:title": "Task ID" },
+        status: { "ui:title": "Status" },
+        type: { "ui:title": "Type" },
+        name: { "ui:title": "Name" },
+        description: { "ui:title": "Description" },
+        validUntil: { "ui:title": "Valid until", "ui:widget": "date" },
+        createdAt: { "ui:title": "Created", "ui:widget": "date" }
+      },
+      replyGuidance: QUERY_TASKS_DETAIL_REPLY_GUIDANCE
+    }
+  );
+}
+function formatAssignTasksResult(results, _assignTo) {
+  const succeeded = results.filter((row) => row.success).length;
+  const title = succeeded === results.length ? `${succeeded === 1 ? "1 task" : `${succeeded} tasks`} reassigned` : `${succeeded}/${results.length} tasks reassigned`;
+  return formatToolListResult(
+    "results",
+    results.map((row) => ({
+      id: row.taskId,
+      name: resolveTaskCardLabel({
+        name: row.name,
+        description: row.description,
+        type: row.type,
+        id: row.taskId
+      }),
+      type: row.type ?? null,
+      description: row.description ?? null,
+      status: row.success ? "reassigned" : "failed"
+    })),
+    {
+      title,
+      itemWidget: "tenantTask",
+      replyGuidance: ASSIGN_TASKS_REPLY_GUIDANCE
+    }
+  );
+}
+
+// src/eve/tools/admin/query-tasks.ts
+var QUERY_TASKS_TOOL_NAME = "query_tasks";
+var queryTasksInputSchema = z12.object({
+  action: z12.enum(["list", "get", "search"]),
+  statusFilter: z12.enum(["all", "open", "handled", "expired"]).optional().describe("Filter by task status for list."),
+  typeFilter: z12.string().optional(),
+  appFilter: z12.string().optional(),
+  sortField: z12.enum(["type", "date", "status", "validUntil"]).optional(),
+  sortDirection: z12.enum(["asc", "desc"]).optional(),
+  limit: z12.number().int().positive().max(100).optional(),
+  cursor: z12.string().optional(),
+  taskId: z12.string().min(1).optional().describe("Public task id or Convex tasks table id for get."),
+  query: z12.string().min(1).optional().describe("Search type, name, description, or id for search.")
+}).superRefine((input, ctx) => {
+  switch (input.action) {
+    case "get":
+      if (!input.taskId) {
+        ctx.addIssue({
+          code: "custom",
+          message: "taskId is required for get.",
+          path: ["taskId"]
+        });
+      }
+      break;
+    case "search":
+      if (!input.query) {
+        ctx.addIssue({
+          code: "custom",
+          message: "query is required for search.",
+          path: ["query"]
+        });
+      }
+      break;
+  }
+});
+function defineQueryTasksTool() {
+  return defineTool7({
+    description: "Tenant-admin tool to list, fetch detail, or search inbox tasks in the workspace. Requires tenant admin access. Results render as chat UI cards \u2014 do not restate task names, ids, or statuses in your reply.",
+    inputSchema: queryTasksInputSchema,
+    async execute(input, ctx) {
+      const api = requireBoundAgentAdminClient(ctx);
+      try {
+        switch (input.action) {
+          case "list": {
+            const result = await api.tasks.list({
+              statusFilter: input.statusFilter,
+              typeFilter: input.typeFilter,
+              appFilter: input.appFilter,
+              sortField: input.sortField,
+              sortDirection: input.sortDirection,
+              limit: input.limit,
+              cursor: input.cursor
+            });
+            return formatTasksListResult(result.items, {
+              nextCursor: result.nextCursor
+            });
+          }
+          case "get": {
+            const result = await api.tasks.get(input.taskId);
+            return formatTaskDetailResult(result.task);
+          }
+          case "search": {
+            const result = await api.tasks.search(input.query, input.limit);
+            return formatTaskSearchResult(
+              result.items,
+              result.total
+            );
+          }
+        }
+      } catch (error) {
+        if (error instanceof RobotRockError) {
+          return {
+            ok: false,
+            status: error.statusCode,
+            message: error.message,
+            response: error.response
+          };
+        }
+        throw error;
+      }
+    }
+  });
+}
+var queryTasksTool = defineQueryTasksTool();
+
+// src/eve/tools/admin/assign-tasks.ts
+import { defineTool as defineTool8 } from "eve/tools";
+import { z as z13 } from "zod";
+var ASSIGN_TASKS_TOOL_NAME = "assign_tasks";
+var assignTasksInputSchema = z13.object({
+  taskIds: z13.array(z13.string().min(1)).min(1).max(100).describe(
+    "Public task ids or Convex tasks table ids to reassign. Use query_tasks search/get to resolve ids first."
+  ),
+  assignTo: assignToSchema.refine(
+    (value) => (value.users?.length ?? 0) > 0 || (value.groups?.length ?? 0) > 0,
+    { message: "assignTo needs at least one user email or group slug." }
+  ).describe(
+    'New assignees \u2014 user emails and/or group slugs (e.g. "finance", virtual "admins").'
+  )
+});
+function defineAssignTasksTool() {
+  return defineTool8({
+    description: "Reassign existing inbox tasks to users or groups. Requires access to each task (tenant admins can reassign any task; others only tasks they can see). Use query_tasks to find task ids when needed. Results render as chat UI \u2014 do not restate task ids or assignees in your reply.",
+    inputSchema: assignTasksInputSchema,
+    async execute(input, ctx) {
+      const api = createBoundAgentAdminClient(ctx);
+      try {
+        const result = await api.tasks.assign({
+          taskIds: input.taskIds,
+          assignTo: input.assignTo
+        });
+        return formatAssignTasksResult(result.results, input.assignTo);
+      } catch (error) {
+        if (error instanceof RobotRockError) {
+          return {
+            ok: false,
+            status: error.statusCode,
+            message: error.message,
+            response: error.response
+          };
+        }
+        throw error;
+      }
+    }
+  });
+}
+var assignTasksTool = defineAssignTasksTool();
+
 // src/eve/tools/index.ts
 function createRobotrockTools(options) {
   const tools = {};
@@ -1637,17 +2814,34 @@ function createRobotrockTools(options) {
   return tools;
 }
 export {
+  ASSIGN_TASKS_TOOL_NAME,
   CREATE_INBOX_TASK_TOOL_NAME,
+  MANAGE_GROUPS_TOOL_NAME,
+  MANAGE_TEAM_MEMBERS_TOOL_NAME,
   MY_ACCESS_TOOL_NAME,
+  QUERY_TASKS_TOOL_NAME,
+  SEARCH_PRODUCTS_TOOL_NAME,
   WHOAMI_TOOL_NAME,
+  assignTasksInputSchema,
+  assignTasksTool,
   createInboxTaskInputSchema,
   createInboxTaskTool,
   createRobotrockTools,
+  defineAssignTasksTool,
   defineCreateInboxTaskTool,
+  defineManageGroupsTool,
+  defineManageTeamMembersTool,
   defineMyAccessTool,
+  defineQueryTasksTool,
+  defineSearchProductsTool,
   defineWhoamiTool,
+  manageGroupsTool,
+  manageTeamMembersTool,
   myAccessInputSchema,
   myAccessTool,
+  queryTasksTool,
+  searchProductsInputSchema,
+  searchProductsTool,
   whoamiInputSchema,
   whoamiTool
 };