robotrock 1.1.0 → 1.3.1

package/dist/eve/agent/index.js

@@ -387,6 +387,89 @@ function parseEveAskQuestionToolOutput(output) {
   return { ...optionId ? { optionId } : {}, ...text ? { text } : {} };
 }
 
+// src/eve/tool-audit.ts
+var MANAGE_TEAM_MEMBERS_TOOL_NAME = "manage_team_members";
+var MANAGE_GROUPS_TOOL_NAME = "manage_groups";
+var CREATE_INBOX_TASK_TOOL_NAME = "create_robotrock_task";
+var MUTATING_TEAM_MEMBER_ACTIONS = /* @__PURE__ */ new Set([
+  "invite",
+  "update_role",
+  "remove"
+]);
+var MUTATING_GROUP_ACTIONS = /* @__PURE__ */ new Set([
+  "create",
+  "update",
+  "delete",
+  "add_member",
+  "remove_member"
+]);
+var SKIP_TOOL_NAMES = /* @__PURE__ */ new Set([
+  CREATE_INBOX_TASK_TOOL_NAME,
+  "ask_question",
+  "closeChat",
+  "requestActionInput"
+]);
+function readAction(input) {
+  const action = input.action;
+  return typeof action === "string" && action.trim().length > 0 ? action.trim() : void 0;
+}
+function shouldAuditToolExecution(toolName, input) {
+  if (SKIP_TOOL_NAMES.has(toolName)) {
+    return false;
+  }
+  const action = readAction(input);
+  if (toolName === MANAGE_TEAM_MEMBERS_TOOL_NAME) {
+    return action != null && MUTATING_TEAM_MEMBER_ACTIONS.has(action);
+  }
+  if (toolName === MANAGE_GROUPS_TOOL_NAME) {
+    return action != null && MUTATING_GROUP_ACTIONS.has(action);
+  }
+  return false;
+}
+var AUDIT_INPUT_KEYS = /* @__PURE__ */ new Set([
+  "action",
+  "email",
+  "userId",
+  "role",
+  "name",
+  "groupId",
+  "description"
+]);
+function sanitizeToolAuditInput(input) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (!AUDIT_INPUT_KEYS.has(key)) {
+      continue;
+    }
+    if (value == null || value === "") {
+      continue;
+    }
+    if (typeof value === "string" || typeof value === "boolean") {
+      sanitized[key] = value;
+      continue;
+    }
+    if (typeof value === "number") {
+      sanitized[key] = value;
+    }
+  }
+  return sanitized;
+}
+function buildChatToolAuditPayload(input) {
+  const sanitized = sanitizeToolAuditInput(input.toolInput);
+  if (!shouldAuditToolExecution(input.toolName, sanitized)) {
+    return null;
+  }
+  const success = input.status === "completed" && input.isError !== true;
+  return {
+    toolCallId: input.toolCallId,
+    toolName: input.toolName,
+    input: sanitized,
+    success,
+    status: input.status,
+    ...input.error ? { error: input.error } : {}
+  };
+}
+
 // src/eve/index.ts
 var ROBOTROCK_READY_HOOK_SLUG = "robotrock-ready";
 
@@ -663,7 +746,7 @@ function robotrockEveChannel(options) {
 }
 
 // src/schemas/index.ts
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 
 // ../core/src/utils/safe-url.ts
 var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
@@ -1050,13 +1133,27 @@ var createAgentChatBodySchema = z.object({
   eveConnectionId: z.string().min(1).optional(),
   /** Source application id; groups the chat under an inbox section. */
   app: z.string().min(1).optional(),
-  assignTo: assignToSchema.optional(),
+  /** Email of the user who owns the chat. Required unless `parentChatId` is set. */
+  ownerEmail: z.string().email().optional(),
   title: z.string().min(1),
   messages: z.array(agentChatSeedMessageSchema).default([]),
   /** Provenance label stored on the session ("cron" | "agent" | ...). */
   source: z.string().min(1).optional()
 }).refine((data) => Boolean(data.agentIdentifier || data.parentChatId), {
   message: "Provide either agentIdentifier or parentChatId"
+}).refine((data) => Boolean(data.ownerEmail || data.parentChatId), {
+  message: "Provide ownerEmail unless parentChatId is set"
+});
+var agentChatAuditToolBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  userId: z.string().min(1),
+  toolCallId: z.string().min(1),
+  toolName: z.string().min(1),
+  input: z.record(z.string(), z.unknown()).default({}),
+  success: z.boolean(),
+  status: z.enum(["completed", "failed", "rejected"]),
+  error: z.string().optional(),
+  idempotencyKey: z.string().optional()
 });
 var agentChatAuditInputBodySchema = z.object({
   eveSessionId: z.string().min(1),
@@ -1096,62 +1193,175 @@ var agentChatLinkTaskBodySchema = z.object({
   toolCallId: z.string().min(1)
 });
 
+// ../core/src/schemas/tool-result-display.ts
+import { z as z2 } from "zod";
+var toolDisplayMetadataSchema = z2.object({
+  widget: z2.string().optional(),
+  title: z2.string().optional(),
+  description: z2.string().optional()
+});
+var toolDisplayEnvelopeSchema = z2.object({
+  display: toolDisplayMetadataSchema.optional(),
+  data: z2.record(z2.string(), z2.unknown()),
+  ui: z2.record(
+    z2.string(),
+    z2.object({
+      "ui:widget": z2.string().optional(),
+      "ui:title": z2.string().optional(),
+      "ui:description": z2.string().optional(),
+      "ui:options": z2.record(z2.string(), z2.unknown()).optional()
+    }).passthrough()
+  ).optional()
+});
+
+// ../core/src/schemas/agent-admin.ts
+import { z as z3 } from "zod";
+var tenantRoleSchema = z3.enum(["admin", "member"]);
+var agentAdminUserSchema = z3.object({
+  id: z3.string(),
+  email: z3.string().email(),
+  name: z3.string()
+});
+var agentAdminMemberSchema = z3.object({
+  userId: z3.string(),
+  role: z3.string(),
+  membershipKind: z3.enum(["team", "assignee"]),
+  hasLoggedIn: z3.boolean(),
+  user: agentAdminUserSchema
+});
+var agentAdminGroupSchema = z3.object({
+  id: z3.string(),
+  name: z3.string(),
+  slug: z3.string(),
+  description: z3.string().nullable(),
+  memberCount: z3.number().optional()
+});
+var agentAdminGroupDetailSchema = agentAdminGroupSchema.extend({
+  members: z3.array(
+    z3.object({
+      userId: z3.string(),
+      user: agentAdminUserSchema
+    })
+  )
+});
+var agentAdminTaskSummarySchema = z3.object({
+  id: z3.string(),
+  convexId: z3.string(),
+  status: z3.string(),
+  type: z3.string().nullable(),
+  name: z3.string().nullable(),
+  description: z3.string().nullable(),
+  validUntil: z3.number(),
+  createdAt: z3.number(),
+  threadPriority: z3.string().nullable(),
+  handledByUserId: z3.string().nullable()
+});
+var inviteMemberBodySchema = z3.object({
+  email: z3.string().email(),
+  role: tenantRoleSchema.optional()
+});
+var updateMemberRoleBodySchema = z3.object({
+  role: tenantRoleSchema
+});
+var createGroupBodySchema = z3.object({
+  name: z3.string().min(1),
+  description: z3.string().optional()
+});
+var updateGroupBodySchema = z3.object({
+  name: z3.string().min(1).optional(),
+  description: z3.string().optional()
+});
+var addGroupMemberBodySchema = z3.object({
+  userId: z3.string().min(1).describe("Convex user id or member email.")
+});
+var listTasksQuerySchema = z3.object({
+  statusFilter: z3.enum(["all", "open", "handled", "expired"]).optional(),
+  typeFilter: z3.string().optional(),
+  appFilter: z3.string().optional(),
+  sortField: z3.enum(["type", "date", "status", "validUntil"]).optional(),
+  sortDirection: z3.enum(["asc", "desc"]).optional(),
+  limit: z3.coerce.number().int().positive().max(100).optional(),
+  cursor: z3.string().optional()
+});
+var searchTasksQuerySchema = z3.object({
+  q: z3.string().min(1),
+  limit: z3.coerce.number().int().positive().max(100).optional()
+});
+var assignTasksResultSchema = z3.object({
+  taskId: z3.string(),
+  success: z3.boolean(),
+  message: z3.string().optional(),
+  name: z3.string().nullable().optional(),
+  description: z3.string().nullable().optional(),
+  type: z3.string().nullable().optional()
+});
+var assignTasksResponseSchema = z3.object({
+  results: z3.array(assignTasksResultSchema)
+});
+var assignTasksBodySchema = z3.object({
+  taskIds: z3.array(z3.string().min(1)).min(1).max(100),
+  assignTo: assignToSchema.refine(
+    (value) => (value.users?.length ?? 0) > 0 || (value.groups?.length ?? 0) > 0,
+    { message: "assignTo needs at least one user email or group slug." }
+  )
+});
+
 // src/schemas/index.ts
-var handlerUrlSchema2 = z2.string().refine((url) => isAllowedHandlerUrl(url), {
+var handlerUrlSchema2 = z4.string().refine((url) => isAllowedHandlerUrl(url), {
   message: HANDLER_URL_ERROR
 });
-var jsonSchema7Schema2 = z2.custom(
+var jsonSchema7Schema2 = z4.custom(
   (val) => typeof val === "object" && val !== null,
   { message: "Must be a valid JSON Schema object" }
 );
-var uiSchemaSchema2 = z2.custom((val) => typeof val === "object" && val !== null, {
+var uiSchemaSchema2 = z4.custom((val) => typeof val === "object" && val !== null, {
   message: "Must be a valid UiSchema object"
 });
-var webhookHandlerSchema2 = z2.object({
-  type: z2.literal("webhook"),
+var webhookHandlerSchema2 = z4.object({
+  type: z4.literal("webhook"),
   url: handlerUrlSchema2,
-  headers: z2.record(z2.string(), z2.string())
+  headers: z4.record(z4.string(), z4.string())
 });
 var triggerHandlerSchema2 = webhookHandlerSchema2.extend({
-  type: z2.literal("trigger"),
-  tokenId: z2.string().min(1)
+  type: z4.literal("trigger"),
+  tokenId: z4.string().min(1)
 });
-var handlerSchema2 = z2.discriminatedUnion("type", [webhookHandlerSchema2, triggerHandlerSchema2]);
-var taskActionInputSchema2 = z2.object({
-  id: z2.string().min(1),
-  title: z2.string().min(1),
-  description: z2.string().optional(),
+var handlerSchema2 = z4.discriminatedUnion("type", [webhookHandlerSchema2, triggerHandlerSchema2]);
+var taskActionInputSchema2 = z4.object({
+  id: z4.string().min(1),
+  title: z4.string().min(1),
+  description: z4.string().optional(),
   schema: jsonSchema7Schema2.optional(),
   ui: uiSchemaSchema2.optional(),
-  data: z2.record(z2.string(), z2.unknown()).optional()
+  data: z4.record(z4.string(), z4.unknown()).optional()
 });
 var taskActionSchema2 = taskActionInputSchema2.extend({
-  handlers: z2.array(handlerSchema2).min(1).optional()
+  handlers: z4.array(handlerSchema2).min(1).optional()
 });
-var uiFieldSchemaSchema2 = z2.object({
-  "ui:widget": z2.string().optional(),
-  "ui:title": z2.string().optional(),
-  "ui:description": z2.string().optional(),
-  "ui:options": z2.record(z2.string(), z2.unknown()).optional(),
-  items: z2.lazy(() => z2.record(z2.string(), uiFieldSchemaSchema2)).optional()
+var uiFieldSchemaSchema2 = z4.object({
+  "ui:widget": z4.string().optional(),
+  "ui:title": z4.string().optional(),
+  "ui:description": z4.string().optional(),
+  "ui:options": z4.record(z4.string(), z4.unknown()).optional(),
+  items: z4.lazy(() => z4.record(z4.string(), uiFieldSchemaSchema2)).optional()
 }).passthrough();
-var contextUiSchema2 = z2.record(z2.string(), uiFieldSchemaSchema2).optional();
-var contextDataSchema2 = z2.object({
-  data: z2.record(z2.string(), z2.unknown()),
+var contextUiSchema2 = z4.record(z4.string(), uiFieldSchemaSchema2).optional();
+var contextDataSchema2 = z4.object({
+  data: z4.record(z4.string(), z4.unknown()),
   ui: contextUiSchema2
 }).optional();
 var TASK_CONTEXT_FORMAT_VERSION2 = 2;
-var taskContextObjectBaseSchema2 = z2.object({
-  app: z2.string().min(1).optional(),
-  type: z2.string().min(1),
-  name: z2.string().min(1),
-  description: z2.string().optional(),
-  validUntil: z2.string().optional(),
+var taskContextObjectBaseSchema2 = z4.object({
+  app: z4.string().min(1).optional(),
+  type: z4.string().min(1),
+  name: z4.string().min(1),
+  description: z4.string().optional(),
+  validUntil: z4.string().optional(),
   context: contextDataSchema2,
-  contextVersion: z2.literal(2).optional(),
+  contextVersion: z4.literal(2).optional(),
   /** @deprecated Use `contextVersion`. Accepted on ingest only. */
-  version: z2.literal(2).optional(),
-  actions: z2.array(taskActionSchema2).min(1, "At least one action is required")
+  version: z4.literal(2).optional(),
+  actions: z4.array(taskActionSchema2).min(1, "At least one action is required")
 });
 function normalizeTaskContextVersion2(data) {
   const { version: legacyVersion, contextVersion, ...rest } = data;
@@ -1167,7 +1377,7 @@ function refineContextPublicUrls2(data, ctx) {
   const error = validateContextPublicUrls(data.context);
   if (error) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z4.ZodIssueCode.custom,
       message: error,
       path: ["context"]
     });
@@ -1176,9 +1386,9 @@ function refineContextPublicUrls2(data, ctx) {
 var taskContextSchema2 = taskContextObjectSchema2.superRefine(
   refineContextPublicUrls2
 );
-var assignToSchema2 = z2.object({
-  users: z2.array(z2.string().email()).optional(),
-  groups: z2.array(z2.string().min(1)).optional()
+var assignToSchema2 = z4.object({
+  users: z4.array(z4.string().email()).optional(),
+  groups: z4.array(z4.string().min(1)).optional()
 }).refine(
   (data) => {
     const groups = data.groups ?? [];
@@ -1189,7 +1399,7 @@ var assignToSchema2 = z2.object({
   },
   { message: 'Cannot combine "all" with other group slugs' }
 );
-var threadUpdateMessageSchema2 = z2.string().min(1).max(500);
+var threadUpdateMessageSchema2 = z4.string().min(1).max(500);
 var threadUpdateStatuses2 = [
   "info",
   "queued",
@@ -1199,15 +1409,15 @@ var threadUpdateStatuses2 = [
   "failed",
   "cancelled"
 ];
-var threadUpdateStatusSchema2 = z2.enum(threadUpdateStatuses2);
-var threadUpdateInputSchema2 = z2.object({
+var threadUpdateStatusSchema2 = z4.enum(threadUpdateStatuses2);
+var threadUpdateInputSchema2 = z4.object({
   message: threadUpdateMessageSchema2,
   status: threadUpdateStatusSchema2.optional()
 });
 var taskPriorities2 = ["low", "normal", "high", "urgent"];
-var taskPrioritySchema2 = z2.enum(taskPriorities2);
-var agentTelemetrySchema2 = z2.object({
-  version: z2.string().min(1)
+var taskPrioritySchema2 = z4.enum(taskPriorities2);
+var agentTelemetrySchema2 = z4.object({
+  version: z4.string().min(1)
 });
 var createTaskBodySchema2 = taskContextObjectBaseSchema2.extend({
   assignTo: assignToSchema2.optional(),
@@ -1215,7 +1425,7 @@ var createTaskBodySchema2 = taskContextObjectBaseSchema2.extend({
    * Groups related tasks together. When omitted, the server generates one and
    * returns it so the caller can reuse it on later tasks in the same thread.
    */
-  threadId: z2.string().min(1).optional(),
+  threadId: z4.string().min(1).optional(),
   /**
    * Optional thread priority. When set, applies to the whole thread and
    * overwrites any previous priority. Omit on later tasks to leave unchanged.
@@ -1230,6 +1440,65 @@ var createTaskBodySchema2 = taskContextObjectBaseSchema2.extend({
 }).transform(normalizeTaskContextVersion2).superRefine(refineContextPublicUrls2);
 var threadUpdateBodySchema = threadUpdateInputSchema2;
 
+// ../core/src/handler-retry.ts
+var HANDLER_RETRY_DELAYS_MS = [
+  6e4,
+  // 1m
+  3e5,
+  // 5m
+  18e5,
+  // 30m
+  36e5,
+  // 1h
+  216e5,
+  // 6h
+  864e5,
+  // 24h
+  1728e5
+  // 48h
+];
+var HANDLER_MAX_ATTEMPTS = HANDLER_RETRY_DELAYS_MS.length + 1;
+
+// ../core/src/attribution/index.ts
+import { z as z5 } from "zod";
+
+// ../core/src/app-url.ts
+var PRODUCTION_APP_URL = "https://app.robotrock.io";
+var PRODUCTION_API_URL = "https://api.robotrock.io/v1";
+var DEV_API_URL = "http://localhost:4001/v1";
+var APP_SIGNUP_URL = `${PRODUCTION_APP_URL}/sign-up`;
+function normalizeRobotRockApiBaseUrl(baseUrl) {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  if (trimmed.endsWith("/v1")) {
+    return trimmed;
+  }
+  return `${trimmed}/v1`;
+}
+function getRobotRockApiBaseUrl() {
+  const explicit = process.env.ROBOTROCK_BASE_URL?.trim() || process.env.ROBOTROCK_API_URL?.trim();
+  if (explicit) {
+    return normalizeRobotRockApiBaseUrl(explicit);
+  }
+  if (process.env.NODE_ENV === "production") {
+    return PRODUCTION_API_URL;
+  }
+  return DEV_API_URL;
+}
+
+// ../core/src/attribution/index.ts
+var ATTRIBUTION_COOKIE_MAX_AGE = 60 * 60 * 24 * 90;
+var attributionSchema = z5.object({
+  utmSource: z5.string().optional(),
+  utmMedium: z5.string().optional(),
+  utmCampaign: z5.string().optional(),
+  utmContent: z5.string().optional(),
+  utmTerm: z5.string().optional(),
+  gclid: z5.string().optional(),
+  landingUrl: z5.string().optional(),
+  referrer: z5.string().optional(),
+  capturedAt: z5.number()
+});
+
 // src/approval-result.ts
 var TaskTimeoutError = class extends Error {
   constructor(message) {
@@ -1304,77 +1573,27 @@ function getErrorMessage(data, fallback) {
   return fallback;
 }
 
-// ../core/src/handler-retry.ts
-var HANDLER_RETRY_DELAYS_MS = [
-  6e4,
-  // 1m
-  3e5,
-  // 5m
-  18e5,
-  // 30m
-  36e5,
-  // 1h
-  216e5,
-  // 6h
-  864e5,
-  // 24h
-  1728e5
-  // 48h
-];
-var HANDLER_MAX_ATTEMPTS = HANDLER_RETRY_DELAYS_MS.length + 1;
-
-// ../core/src/attribution/index.ts
-import { z as z3 } from "zod";
-
-// ../core/src/app-url.ts
-var PRODUCTION_APP_URL = "https://app.robotrock.io";
-var PRODUCTION_API_URL = "https://api.robotrock.io/v1";
-var DEV_API_URL = "http://localhost:4001/v1";
-var APP_SIGNUP_URL = `${PRODUCTION_APP_URL}/sign-up`;
-function normalizeRobotRockApiBaseUrl(baseUrl) {
-  const trimmed = baseUrl.trim().replace(/\/+$/, "");
-  if (trimmed.endsWith("/v1")) {
-    return trimmed;
-  }
-  return `${trimmed}/v1`;
-}
-function getRobotRockApiBaseUrl() {
-  const explicit = process.env.ROBOTROCK_BASE_URL?.trim() || process.env.ROBOTROCK_API_URL?.trim();
-  if (explicit) {
-    return normalizeRobotRockApiBaseUrl(explicit);
-  }
-  if (process.env.NODE_ENV === "production") {
-    return PRODUCTION_API_URL;
-  }
-  return DEV_API_URL;
-}
-
-// ../core/src/attribution/index.ts
-var ATTRIBUTION_COOKIE_MAX_AGE = 60 * 60 * 24 * 90;
-var attributionSchema = z3.object({
-  utmSource: z3.string().optional(),
-  utmMedium: z3.string().optional(),
-  utmCampaign: z3.string().optional(),
-  utmContent: z3.string().optional(),
-  utmTerm: z3.string().optional(),
-  gclid: z3.string().optional(),
-  landingUrl: z3.string().optional(),
-  referrer: z3.string().optional(),
-  capturedAt: z3.number()
-});
-
 // src/auth-headers.ts
+var ROBOTROCK_ACTING_USER_ID_HEADER = "x-robotrock-acting-user-id";
 function buildRobotRockAuthHeaders(auth) {
   if (auth.kind === "apiKey") {
-    return {
+    const headers2 = {
       "X-Api-Key": auth.apiKey
     };
+    if (auth.actingUserId?.trim()) {
+      headers2[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+    }
+    return headers2;
   }
-  return {
+  const headers = {
     Authorization: `Bearer ${auth.token}`,
     "X-RobotRock-Tenant-Slug": auth.tenantSlug,
     "X-RobotRock-Connection-Id": auth.connectionId
   };
+  if (auth.actingUserId?.trim()) {
+    headers[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+  }
+  return headers;
 }
 function resolveRobotRockAuthConfig(overrides) {
   if (overrides?.agentService) {
@@ -1518,6 +1737,29 @@ function createChatsApi(config) {
         );
       }
     },
+    async logToolExecution(input) {
+      const validation = agentChatAuditToolBodySchema.safeParse(input);
+      if (!validation.success) {
+        throw new RobotRockError(
+          `Invalid audit tool input: ${validation.error.issues[0]?.message}`,
+          400,
+          validation.error.issues
+        );
+      }
+      const response = await fetch(`${config.baseUrl}/agent-chats/audit-tool`, {
+        method: "POST",
+        headers: headers(),
+        body: JSON.stringify(validation.data)
+      });
+      if (!response.ok) {
+        const data = await parseResponseBody(response);
+        throw new RobotRockError(
+          getErrorMessage(data, "Failed to log chat tool execution"),
+          response.status,
+          data
+        );
+      }
+    },
     async linkTask(input) {
       const validation = agentChatLinkTaskBodySchema.safeParse(input);
       if (!validation.success) {
@@ -1620,7 +1862,9 @@ var RobotRock = class {
       create: (task) => this.createTaskRequest(task),
       get: (taskId) => this.getTaskById(taskId),
       cancel: (taskId) => this.cancelTaskRequest(taskId),
-      sendUpdate: (input) => this.sendThreadUpdate(input)
+      sendUpdate: (input) => this.sendThreadUpdate(input),
+      list: (input) => this.listTasksRequest(input),
+      search: (input) => this.searchTasksRequest(input)
     };
     this.chats = createChatsApi({
       baseUrl: this.baseUrl,
@@ -1817,6 +2061,47 @@ var RobotRock = class {
       );
     }
   }
+  async listTasksRequest(input) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(input ?? {})) {
+      if (value !== void 0 && value !== "") {
+        params.set(key, String(value));
+      }
+    }
+    const suffix = params.size > 0 ? `?${params.toString()}` : "";
+    const response = await fetch(`${this.baseUrl}/tasks${suffix}`, {
+      method: "GET",
+      headers: this.authHeaders()
+    });
+    const data = await parseResponseBody(response);
+    if (!response.ok) {
+      throw new RobotRockError(
+        getErrorMessage(data, "Failed to list tasks"),
+        response.status,
+        data
+      );
+    }
+    return data;
+  }
+  async searchTasksRequest(input) {
+    const params = new URLSearchParams({ q: input.q });
+    if (input.limit !== void 0) {
+      params.set("limit", String(input.limit));
+    }
+    const response = await fetch(`${this.baseUrl}/tasks/search?${params.toString()}`, {
+      method: "GET",
+      headers: this.authHeaders()
+    });
+    const data = await parseResponseBody(response);
+    if (!response.ok) {
+      throw new RobotRockError(
+        getErrorMessage(data, "Failed to search tasks"),
+        response.status,
+        data
+      );
+    }
+    return data;
+  }
 };
 function createClient(config) {
   return new RobotRock(config);
@@ -1953,6 +2238,23 @@ function logAuditFailure(label, error) {
   const hint = error instanceof RobotRockError && error.statusCode === 405 ? " \u2014 set ROBOTROCK_BASE_URL=http://localhost:4001/v1 and run the local API" : "";
   console.warn(`robotrock-chat-audit: failed to ${label}${hint}`, error);
 }
+async function postRobotRockChatToolAudit(ctx, payload) {
+  const client = tryCreateBoundRobotRockClient(ctx);
+  if (!client) {
+    if (!warnedMissingAuth2) {
+      warnedMissingAuth2 = true;
+      console.warn(
+        "robotrock-chat-audit: RobotRock auth is unset; skipping tool audit logging."
+      );
+    }
+    return;
+  }
+  try {
+    await client.chats.logToolExecution(payload);
+  } catch (error) {
+    logAuditFailure("log tool execution", error);
+  }
+}
 async function postRobotRockChatInputAudit(ctx, payload) {
   const client = tryCreateBoundRobotRockClient(ctx);
   if (!client) {
@@ -2135,7 +2437,7 @@ async function createRobotRockCronChat(input) {
     title: input.title,
     messages: input.messages,
     source: "cron",
-    assignTo: input.assignTo
+    ownerEmail: input.ownerEmail
   });
 }
 
@@ -2149,6 +2451,8 @@ function defineRobotRockReadyHook() {
 // src/eve/agent/hooks/chat-audit.ts
 import { defineHook as defineHook2 } from "eve/hooks";
 var loggedIdempotencyKeys = /* @__PURE__ */ new Set();
+var loggedToolCallIds = /* @__PURE__ */ new Set();
+var pendingToolCallsBySession = /* @__PURE__ */ new Map();
 function toEveInputRequest(request) {
   return {
     requestId: request.requestId,
@@ -2158,6 +2462,22 @@ function toEveInputRequest(request) {
     ...request.options ? { options: request.options } : {}
   };
 }
+function stashPendingToolCall(sessionId, callId, toolName, input) {
+  const sessionCalls = pendingToolCallsBySession.get(sessionId) ?? /* @__PURE__ */ new Map();
+  sessionCalls.set(callId, { toolName, input });
+  pendingToolCallsBySession.set(sessionId, sessionCalls);
+}
+function takePendingToolCall(sessionId, callId) {
+  const sessionCalls = pendingToolCallsBySession.get(sessionId);
+  const pending = sessionCalls?.get(callId);
+  if (pending && sessionCalls) {
+    sessionCalls.delete(callId);
+    if (sessionCalls.size === 0) {
+      pendingToolCallsBySession.delete(sessionId);
+    }
+  }
+  return pending;
+}
 async function logPendingInputResponse(ctx, pending, response) {
   const caller = tryResolveTenantCaller(ctx);
   if (!caller) {
@@ -2194,11 +2514,70 @@ async function logPendingInputResponse(ctx, pending, response) {
   });
   loggedIdempotencyKeys.add(idempotencyKey);
 }
+async function logToolExecutionFromResult(ctx, event) {
+  const result = event.data.result;
+  if (result.kind !== "tool-result") {
+    return;
+  }
+  const callId = result.callId;
+  const toolName = result.toolName;
+  if (!callId || !toolName) {
+    return;
+  }
+  const dedupeKey = `${ctx.session.id}:${callId}`;
+  if (loggedToolCallIds.has(dedupeKey)) {
+    return;
+  }
+  const pending = takePendingToolCall(ctx.session.id, callId) ?? { toolName, input: {} };
+  const payload = buildChatToolAuditPayload({
+    toolCallId: callId,
+    toolName: pending.toolName,
+    toolInput: pending.input,
+    status: event.data.status,
+    isError: result.isError,
+    error: event.data.error?.message
+  });
+  if (!payload) {
+    return;
+  }
+  const caller = tryResolveTenantCaller(ctx);
+  if (!caller) {
+    return;
+  }
+  await postRobotRockChatToolAudit(ctx, {
+    eveSessionId: ctx.session.id,
+    userId: caller.userId,
+    toolCallId: payload.toolCallId,
+    toolName: payload.toolName,
+    input: payload.input,
+    success: payload.success,
+    status: payload.status,
+    ...payload.error ? { error: payload.error } : {},
+    idempotencyKey: dedupeKey
+  });
+  loggedToolCallIds.add(dedupeKey);
+}
 function resetRobotrockChatAuditIdempotencyKeys() {
   loggedIdempotencyKeys.clear();
+  loggedToolCallIds.clear();
+  pendingToolCallsBySession.clear();
 }
 var robotrockChatAuditHook = defineHook2({
   events: {
+    async "actions.requested"(event, ctx) {
+      for (const action of event.data.actions) {
+        if (action.kind !== "tool-call") {
+          continue;
+        }
+        const input = action.input != null && typeof action.input === "object" && !Array.isArray(action.input) ? action.input : {};
+        stashPendingToolCall(
+          ctx.session.id,
+          action.callId,
+          action.toolName,
+          input
+        );
+      }
+    },
     async "input.requested"(event, ctx) {
       const requests = [];
       for (const request of event.data.requests) {
@@ -2242,51 +2621,201 @@ var robotrockChatAuditHook = defineHook2({
     },
     async "action.result"(event, ctx) {
       const result = event.data.result;
-      if (result.kind !== "tool-result") {
-        return;
-      }
-      const staged = await fetchRobotRockStagedHitl(ctx, ctx.session.id);
-      const pending = staged.find((entry) => entry.toolCallId === result.callId);
-      if (!pending) {
-        return;
-      }
-      const idempotencyKey = `${ctx.session.id}:${pending.requestId}`;
-      if (loggedIdempotencyKeys.has(idempotencyKey)) {
-        return;
-      }
-      if (pending.toolName === "ask_question") {
-        const parsed = parseEveAskQuestionToolOutput(result.output);
-        if (!parsed) {
-          return;
+      if (result.kind === "tool-result") {
+        const staged = await fetchRobotRockStagedHitl(ctx, ctx.session.id);
+        const pending = staged.find((entry) => entry.toolCallId === result.callId);
+        if (pending) {
+          const idempotencyKey = `${ctx.session.id}:${pending.requestId}`;
+          if (!loggedIdempotencyKeys.has(idempotencyKey)) {
+            if (pending.toolName === "ask_question") {
+              const parsed = parseEveAskQuestionToolOutput(result.output);
+              if (parsed) {
+                await logPendingInputResponse(ctx, pending, {
+                  requestId: pending.requestId,
+                  ...parsed
+                });
+              }
+            } else if (isEveApprovalInputRequest(toEveInputRequest(pending))) {
+              if (event.data.status === "rejected") {
+                await logPendingInputResponse(ctx, pending, {
+                  requestId: pending.requestId,
+                  optionId: "deny"
+                });
+              } else if (event.data.status === "completed") {
+                await logPendingInputResponse(ctx, pending, {
+                  requestId: pending.requestId,
+                  optionId: "approve"
+                });
+              }
+            }
+          }
         }
-        await logPendingInputResponse(ctx, pending, {
-          requestId: pending.requestId,
-          ...parsed
-        });
-        return;
-      }
-      if (!isEveApprovalInputRequest(toEveInputRequest(pending))) {
-        return;
-      }
-      if (event.data.status === "rejected") {
-        await logPendingInputResponse(ctx, pending, {
-          requestId: pending.requestId,
-          optionId: "deny"
-        });
-        return;
-      }
-      if (event.data.status === "completed") {
-        await logPendingInputResponse(ctx, pending, {
-          requestId: pending.requestId,
-          optionId: "approve"
-        });
       }
+      await logToolExecutionFromResult(ctx, event);
     }
   }
 });
 function defineRobotRockChatAuditHook() {
   return robotrockChatAuditHook;
 }
+
+// src/agent-admin.ts
+async function agentAdminFetch(config, path, init) {
+  const baseUrl = (config.baseUrl?.trim() || getRobotRockApiBaseUrl()).replace(
+    /\/+$/,
+    ""
+  );
+  const url = `${baseUrl}/agent-admin${path}`;
+  const response = await fetch(url, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      ...buildRobotRockAuthHeaders(config.auth),
+      ...init?.headers ?? {}
+    }
+  });
+  const data = await parseResponseBody(response);
+  if (!response.ok) {
+    throw new RobotRockError(
+      getErrorMessage(data, `Agent admin request failed (${response.status})`),
+      response.status,
+      data
+    );
+  }
+  return data;
+}
+function createAgentAdminApi(config) {
+  return {
+    members: {
+      list: () => agentAdminFetch(config, "/members"),
+      get: (memberRef) => agentAdminFetch(config, `/members/${encodeURIComponent(memberRef)}`),
+      invite: (body) => agentAdminFetch(config, "/members", {
+        method: "POST",
+        body: JSON.stringify(body)
+      }),
+      updateRole: (memberRef, role) => agentAdminFetch(
+        config,
+        `/members/${encodeURIComponent(memberRef)}/role`,
+        {
+          method: "PATCH",
+          body: JSON.stringify({ role })
+        }
+      ),
+      remove: (memberId) => agentAdminFetch(
+        config,
+        `/members/${encodeURIComponent(memberId)}`,
+        {
+          method: "DELETE"
+        }
+      )
+    },
+    groups: {
+      list: () => agentAdminFetch(config, "/groups"),
+      get: (groupId) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`
+      ),
+      create: (body) => agentAdminFetch(config, "/groups", {
+        method: "POST",
+        body: JSON.stringify(body)
+      }),
+      update: (groupId, body) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`,
+        {
+          method: "PATCH",
+          body: JSON.stringify(body)
+        }
+      ),
+      delete: (groupId) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`,
+        {
+          method: "DELETE"
+        }
+      ),
+      addMember: (groupRef, memberRef) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupRef)}/members`,
+        {
+          method: "POST",
+          body: JSON.stringify({ userId: memberRef })
+        }
+      ),
+      removeMember: (groupRef, memberRef) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupRef)}/members/${encodeURIComponent(memberRef)}`,
+        { method: "DELETE" }
+      )
+    },
+    tasks: {
+      list: (query) => {
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(query ?? {})) {
+          if (value !== void 0 && value !== "") {
+            params.set(key, String(value));
+          }
+        }
+        const suffix = params.size > 0 ? `?${params.toString()}` : "";
+        return agentAdminFetch(
+          config,
+          `/tasks${suffix}`
+        );
+      },
+      search: (q, limit) => {
+        const params = new URLSearchParams({ q });
+        if (limit !== void 0) {
+          params.set("limit", String(limit));
+        }
+        return agentAdminFetch(
+          config,
+          `/tasks/search?${params.toString()}`
+        );
+      },
+      get: (taskId) => agentAdminFetch(config, `/tasks/${taskId}`),
+      assign: (body) => agentAdminFetch(config, "/tasks/assign", {
+        method: "POST",
+        body: JSON.stringify(body)
+      })
+    }
+  };
+}
+function createBoundAgentAdminClient(ctx) {
+  const caller = requireTenantCaller(ctx);
+  const baseUrl = process.env.ROBOTROCK_BASE_URL?.trim();
+  const serviceToken = process.env.ROBOTROCK_AGENT_SERVICE_TOKEN?.trim();
+  if (caller.connectionId && serviceToken) {
+    return createAgentAdminApi({
+      baseUrl,
+      auth: resolveRobotRockAuthConfig({
+        agentService: {
+          token: serviceToken,
+          tenantSlug: caller.tenantSlug,
+          connectionId: caller.connectionId,
+          actingUserId: caller.userId
+        }
+      })
+    });
+  }
+  const apiKey = process.env.ROBOTROCK_API_KEY?.trim();
+  if (apiKey) {
+    return createAgentAdminApi({
+      baseUrl,
+      auth: {
+        kind: "apiKey",
+        apiKey,
+        actingUserId: caller.userId
+      }
+    });
+  }
+  throw new Error(
+    "Agent admin auth is unset. Set ROBOTROCK_AGENT_SERVICE_TOKEN for hosted multi-tenant agents, or ROBOTROCK_API_KEY for self-hosted and localhost deployments."
+  );
+}
+function requireBoundAgentAdminClient(ctx) {
+  requireAdminCaller(ctx);
+  return createBoundAgentAdminClient(ctx);
+}
 export {
   ROBOTROCK_PLATFORM_USER_CONTEXT_PUBLIC_KEY_URL,
   ROBOTROCK_READY_HOOK_SLUG,
@@ -2294,6 +2823,8 @@ export {
   ROBOTROCK_USER_CONTEXT_HEADER,
   ROBOTROCK_USER_CONTEXT_ISSUER,
   buildRobotRockTaskPayload,
+  createAgentAdminApi,
+  createBoundAgentAdminClient,
   createRobotRockCronChat,
   createRobotRockTask,
   defineRobotRockChatAuditHook,
@@ -2305,6 +2836,7 @@ export {
   postRobotRockLinkChatTask,
   postRobotRockStageHitl,
   requireAdminCaller,
+  requireBoundAgentAdminClient,
   requireTenantCaller,
   resetBoundClientAuthWarning,
   resetChatAuditWarnings,