robotrock 1.3.0 → 1.3.2

package/dist/{auth-headers-qL-ZeEtd.d.ts → chat-correlation-BsHD-tOQ.d.ts}

@@ -10,4 +10,9 @@ type RobotRockAuthConfig = {
     actingUserId?: string;
 };
 
-export type { RobotRockAuthConfig as R };
+type ChatCorrelation = {
+    chatId?: string;
+    eveSessionId?: string;
+};
+
+export type { ChatCorrelation as C, RobotRockAuthConfig as R };

package/dist/{client-YO9Y1rkH.d.ts → client-CZ5eWH5v.d.ts}

@@ -1,7 +1,7 @@
 import { TaskContextInput, AssignToInput, TaskPriority, ThreadUpdateStatus, TaskResponse, Task, ThreadUpdate, TaskContextFormatVersion, DiscriminatedApprovalResult } from './schemas/index.js';
 import { AgentChatSeedMessage, AgentChatStageHitlBody, AgentChatAuditInputBody, AgentChatAuditToolBody, AgentChatLinkTaskBody, listTasksQuerySchema, AgentAdminTaskSummary } from '@robotrock/core';
 import { z } from 'zod';
-import { R as RobotRockAuthConfig } from './auth-headers-qL-ZeEtd.js';
+import { R as RobotRockAuthConfig, C as ChatCorrelation } from './chat-correlation-BsHD-tOQ.js';
 
 /** A chat created via {@link ChatsApi.create}. */
 type CreatedChat = {
@@ -66,6 +66,7 @@ declare function createChatsApi(config: {
     baseUrl: string;
     auth: RobotRockAuthConfig;
     app?: string;
+    chatCorrelation?: ChatCorrelation;
 }): ChatsApi;
 
 type RobotRockWebhookConfig = {
@@ -88,6 +89,8 @@ type RobotRockAdvancedConfig = {
     contextVersion?: TaskContextFormatVersion;
 };
 type RobotRockClientBaseConfig = {
+    /** Optional chat correlation headers for audit logging from agent sessions. */
+    chatCorrelation?: ChatCorrelation;
     /** Optional override for API key. Falls back to ROBOTROCK_API_KEY when agentService is unset. */
     apiKey?: string;
     /** Hosted-agent service auth (mutually exclusive with apiKey). */
@@ -95,6 +98,7 @@ type RobotRockClientBaseConfig = {
         token: string;
         tenantSlug: string;
         connectionId: string;
+        actingUserId?: string;
     };
     /**
      * Base URL for the RobotRock API
@@ -214,6 +218,7 @@ interface TasksApi {
  */
 declare class RobotRock {
     private readonly auth;
+    private readonly chatCorrelation?;
     private readonly baseUrl;
     private readonly app?;
     private readonly agentVersion?;

package/dist/eve/agent/index.d.ts

@@ -1,17 +1,17 @@
-export { a as TenantCaller, T as TenantRole, i as isAdminCaller, r as requireAdminCaller, b as requireTenantCaller, t as tryResolveTenantCaller } from '../../tenant-5YKDrdC-.js';
+export { a as TenantCaller, T as TenantRole, i as isAdminCaller, r as requireAdminCaller, b as requireTenantCaller, t as tryResolveTenantCaller } from '../../tenant-DmN0MMyC.js';
 import { AuthFn, vercelOidc } from 'eve/channels/auth';
 import * as eve_channels_eve from 'eve/channels/eve';
-import { R as RobotRock, q as StagedChatHitlRequest, a as SendToHumanInput, S as SendToHumanActionInput, e as CreateChatResult } from '../../client-YO9Y1rkH.js';
+import { R as RobotRock, q as StagedChatHitlRequest, a as SendToHumanInput, S as SendToHumanActionInput, e as CreateChatResult } from '../../client-CZ5eWH5v.js';
 import { SessionContext } from 'eve/context';
 import { TaskPriority } from '../../schemas/index.js';
 import { HookDefinition } from 'eve/hooks';
 export { AgentAdminApi, createAgentAdminApi, createBoundAgentAdminClient, requireBoundAgentAdminClient } from '../../agent-admin.js';
 export { ROBOTROCK_PLATFORM_USER_CONTEXT_PUBLIC_KEY_URL } from '@robotrock/core/eve/platform-user-context-public-key';
-export { R as ROBOTROCK_READY_HOOK_SLUG } from '../../index-DoQN48Bm.js';
+export { R as ROBOTROCK_READY_HOOK_SLUG } from '../../index-DePyAbTI.js';
 export { ROBOTROCK_USER_CONTEXT_AUDIENCE, ROBOTROCK_USER_CONTEXT_ISSUER } from '@robotrock/core/eve/user-context-jwt';
 import '@robotrock/core';
 import 'zod';
-import '../../auth-headers-qL-ZeEtd.js';
+import '../../chat-correlation-BsHD-tOQ.js';
 import '@robotrock/core/schemas';
 import '../../tool-reply-guidance-C3qrT1In.js';
 

package/dist/eve/agent/index.js

@@ -89,6 +89,7 @@ function verifyRobotRockPlatformUserContextJwt(args) {
   const connectionId = readStringClaim(payload, "connectionId");
   const role = parseTenantRoleClaim(readStringClaim(payload, "role"));
   const workosUserId = readStringClaim(payload, "workosUserId");
+  const chatId = readStringClaim(payload, "chatId");
   const iat = payload.iat;
   const exp = payload.exp;
   if (!sub || !email || !name || !tenantSlug || !connectionId || !role || typeof iat !== "number" || typeof exp !== "number") {
@@ -107,6 +108,7 @@ function verifyRobotRockPlatformUserContextJwt(args) {
       role,
       groups: readGroupsClaim(payload),
       ...workosUserId ? { workosUserId } : {},
+      ...chatId ? { chatId } : {},
       iat,
       exp
     }
@@ -387,89 +389,6 @@ function parseEveAskQuestionToolOutput(output) {
   return { ...optionId ? { optionId } : {}, ...text ? { text } : {} };
 }
 
-// src/eve/tool-audit.ts
-var MANAGE_TEAM_MEMBERS_TOOL_NAME = "manage_team_members";
-var MANAGE_GROUPS_TOOL_NAME = "manage_groups";
-var CREATE_INBOX_TASK_TOOL_NAME = "create_robotrock_task";
-var MUTATING_TEAM_MEMBER_ACTIONS = /* @__PURE__ */ new Set([
-  "invite",
-  "update_role",
-  "remove"
-]);
-var MUTATING_GROUP_ACTIONS = /* @__PURE__ */ new Set([
-  "create",
-  "update",
-  "delete",
-  "add_member",
-  "remove_member"
-]);
-var SKIP_TOOL_NAMES = /* @__PURE__ */ new Set([
-  CREATE_INBOX_TASK_TOOL_NAME,
-  "ask_question",
-  "closeChat",
-  "requestActionInput"
-]);
-function readAction(input) {
-  const action = input.action;
-  return typeof action === "string" && action.trim().length > 0 ? action.trim() : void 0;
-}
-function shouldAuditToolExecution(toolName, input) {
-  if (SKIP_TOOL_NAMES.has(toolName)) {
-    return false;
-  }
-  const action = readAction(input);
-  if (toolName === MANAGE_TEAM_MEMBERS_TOOL_NAME) {
-    return action != null && MUTATING_TEAM_MEMBER_ACTIONS.has(action);
-  }
-  if (toolName === MANAGE_GROUPS_TOOL_NAME) {
-    return action != null && MUTATING_GROUP_ACTIONS.has(action);
-  }
-  return false;
-}
-var AUDIT_INPUT_KEYS = /* @__PURE__ */ new Set([
-  "action",
-  "email",
-  "userId",
-  "role",
-  "name",
-  "groupId",
-  "description"
-]);
-function sanitizeToolAuditInput(input) {
-  const sanitized = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (!AUDIT_INPUT_KEYS.has(key)) {
-      continue;
-    }
-    if (value == null || value === "") {
-      continue;
-    }
-    if (typeof value === "string" || typeof value === "boolean") {
-      sanitized[key] = value;
-      continue;
-    }
-    if (typeof value === "number") {
-      sanitized[key] = value;
-    }
-  }
-  return sanitized;
-}
-function buildChatToolAuditPayload(input) {
-  const sanitized = sanitizeToolAuditInput(input.toolInput);
-  if (!shouldAuditToolExecution(input.toolName, sanitized)) {
-    return null;
-  }
-  const success = input.status === "completed" && input.isError !== true;
-  return {
-    toolCallId: input.toolCallId,
-    toolName: input.toolName,
-    input: sanitized,
-    success,
-    status: input.status,
-    ...input.error ? { error: input.error } : {}
-  };
-}
-
 // src/eve/index.ts
 var ROBOTROCK_READY_HOOK_SLUG = "robotrock-ready";
 
@@ -521,6 +440,7 @@ function tryResolveTenantCaller(ctx) {
   }
   const workosUserId = readStringAttribute(caller.attributes, "workosUserId");
   const connectionId = readStringAttribute(caller.attributes, "connectionId");
+  const chatId = readStringAttribute(caller.attributes, "chatId");
   const groups = readStringArrayAttribute(caller.attributes, "groups");
   return {
     userId: caller.principalId,
@@ -528,6 +448,7 @@ function tryResolveTenantCaller(ctx) {
     name: name ?? email.split("@")[0] ?? email,
     tenantSlug,
     ...connectionId ? { connectionId } : {},
+    ...chatId ? { chatId } : {},
     role,
     isAdmin: role === "admin",
     groups,
@@ -601,7 +522,8 @@ function mapVerifiedClaimsToSessionAuth(claims) {
       role: claims.role,
       groups: claims.groups,
       ...claims.connectionId ? { connectionId: claims.connectionId } : {},
-      ...claims.workosUserId ? { workosUserId: claims.workosUserId } : {}
+      ...claims.workosUserId ? { workosUserId: claims.workosUserId } : {},
+      ...claims.chatId ? { chatId: claims.chatId } : {}
     }
   };
 }
@@ -665,12 +587,14 @@ function robotrockUserContextAuth(options) {
       result.sessionAuth.attributes,
       "workosUserId"
     );
+    const chatId = readStringAttribute(result.sessionAuth.attributes, "chatId");
     return mapVerifiedClaimsToSessionAuth({
       sub: subject,
       email,
       name: name ?? email.split("@")[0] ?? email,
       tenantSlug,
       connectionId,
+      chatId,
       role,
       groups,
       workosUserId
@@ -1611,11 +1535,42 @@ function resolveRobotRockAuthConfig(overrides) {
   return { kind: "apiKey", apiKey };
 }
 
+// src/chat-correlation.ts
+var ROBOTROCK_CHAT_ID_HEADER = "x-robotrock-chat-id";
+var ROBOTROCK_EVE_SESSION_ID_HEADER = "x-robotrock-eve-session-id";
+function resolveChatCorrelationFromEnv() {
+  const chatId = process.env.ROBOTROCK_CHAT_ID?.trim();
+  const eveSessionId = process.env.ROBOTROCK_EVE_SESSION_ID?.trim();
+  if (!chatId && !eveSessionId) {
+    return void 0;
+  }
+  return {
+    ...chatId ? { chatId } : {},
+    ...eveSessionId ? { eveSessionId } : {}
+  };
+}
+function buildChatCorrelationHeaders(correlation) {
+  if (!correlation) {
+    return {};
+  }
+  const headers = {};
+  const chatId = correlation.chatId?.trim();
+  const eveSessionId = correlation.eveSessionId?.trim();
+  if (chatId) {
+    headers[ROBOTROCK_CHAT_ID_HEADER] = chatId;
+  }
+  if (eveSessionId) {
+    headers[ROBOTROCK_EVE_SESSION_ID_HEADER] = eveSessionId;
+  }
+  return headers;
+}
+
 // src/chats.ts
 function createChatsApi(config) {
   const headers = () => ({
     "Content-Type": "application/json",
-    ...buildRobotRockAuthHeaders(config.auth)
+    ...buildRobotRockAuthHeaders(config.auth),
+    ...buildChatCorrelationHeaders(config.chatCorrelation)
   });
   return {
     async create(input) {
@@ -1825,6 +1780,7 @@ function serializeValidUntil(value) {
 }
 var RobotRock = class {
   auth;
+  chatCorrelation;
   baseUrl;
   app;
   agentVersion;
@@ -1852,6 +1808,7 @@ var RobotRock = class {
       ...apiKey ? { apiKey } : {},
       ...agentService ? { agentService } : {}
     });
+    this.chatCorrelation = config.chatCorrelation;
     this.baseUrl = config.baseUrl ?? getRobotRockApiBaseUrl();
     this.app = config.app;
     this.agentVersion = config.version ?? resolveAgentVersionFromEnv();
@@ -1869,13 +1826,15 @@ var RobotRock = class {
     this.chats = createChatsApi({
       baseUrl: this.baseUrl,
       auth: this.auth,
-      app: this.app
+      app: this.app,
+      chatCorrelation: this.chatCorrelation
     });
   }
   authHeaders(extra) {
     return {
       "Content-Type": "application/json",
       ...buildRobotRockAuthHeaders(this.auth),
+      ...buildChatCorrelationHeaders(this.chatCorrelation),
       ...extra
     };
   }
@@ -2146,51 +2105,39 @@ function normalizeSendToHumanInput(task, clientDefaults) {
   };
 }
 
-// src/env.ts
-function resolveRobotRockConfig(overrides) {
-  const agentService = overrides?.agentService;
-  const apiKey = overrides?.apiKey ?? process.env.ROBOTROCK_API_KEY;
-  if (agentService && apiKey) {
-    throw new Error(
-      "RobotRock client cannot configure both apiKey and agentService."
-    );
-  }
-  const baseUrl = overrides?.baseUrl ?? getRobotRockApiBaseUrl();
-  const app = overrides?.app ?? process.env.ROBOTROCK_APP;
-  if (agentService) {
-    return app ? { agentService, baseUrl, app } : { agentService, baseUrl };
-  }
-  if (!apiKey) {
-    throw new Error(
-      "RobotRock API key is required. Set ROBOTROCK_API_KEY or pass agentService when creating the client."
-    );
-  }
-  return app ? { apiKey, baseUrl, app } : { apiKey, baseUrl };
-}
-
 // src/eve/agent/client-from-session.ts
 var warnedMissingAuth = false;
+function resolveBoundChatCorrelation(ctx) {
+  const caller = tryResolveTenantCaller(ctx);
+  return {
+    eveSessionId: ctx.session.id,
+    ...caller?.chatId ? { chatId: caller.chatId } : {},
+    ...resolveChatCorrelationFromEnv()
+  };
+}
 function tryCreateBoundRobotRockClient(ctx) {
   const caller = tryResolveTenantCaller(ctx);
   const serviceToken = process.env.ROBOTROCK_AGENT_SERVICE_TOKEN?.trim();
+  const chatCorrelation = resolveBoundChatCorrelation(ctx);
   if (caller?.connectionId && serviceToken) {
     return createClient({
       baseUrl: process.env.ROBOTROCK_BASE_URL?.trim(),
+      chatCorrelation,
       agentService: {
         token: serviceToken,
         tenantSlug: caller.tenantSlug,
-        connectionId: caller.connectionId
+        connectionId: caller.connectionId,
+        actingUserId: caller.userId
       }
     });
   }
   const apiKey = process.env.ROBOTROCK_API_KEY?.trim();
   if (apiKey) {
-    return createClient(
-      resolveRobotRockConfig({
-        apiKey,
-        baseUrl: process.env.ROBOTROCK_BASE_URL?.trim()
-      })
-    );
+    return createClient({
+      apiKey,
+      baseUrl: process.env.ROBOTROCK_BASE_URL?.trim(),
+      chatCorrelation
+    });
   }
   if (!warnedMissingAuth) {
     warnedMissingAuth = true;
@@ -2238,23 +2185,6 @@ function logAuditFailure(label, error) {
   const hint = error instanceof RobotRockError && error.statusCode === 405 ? " \u2014 set ROBOTROCK_BASE_URL=http://localhost:4001/v1 and run the local API" : "";
   console.warn(`robotrock-chat-audit: failed to ${label}${hint}`, error);
 }
-async function postRobotRockChatToolAudit(ctx, payload) {
-  const client = tryCreateBoundRobotRockClient(ctx);
-  if (!client) {
-    if (!warnedMissingAuth2) {
-      warnedMissingAuth2 = true;
-      console.warn(
-        "robotrock-chat-audit: RobotRock auth is unset; skipping tool audit logging."
-      );
-    }
-    return;
-  }
-  try {
-    await client.chats.logToolExecution(payload);
-  } catch (error) {
-    logAuditFailure("log tool execution", error);
-  }
-}
 async function postRobotRockChatInputAudit(ctx, payload) {
   const client = tryCreateBoundRobotRockClient(ctx);
   if (!client) {
@@ -2422,6 +2352,28 @@ function buildRobotRockTaskPayload(input, options) {
   return payload;
 }
 
+// src/env.ts
+function resolveRobotRockConfig(overrides) {
+  const agentService = overrides?.agentService;
+  const apiKey = overrides?.apiKey ?? process.env.ROBOTROCK_API_KEY;
+  if (agentService && apiKey) {
+    throw new Error(
+      "RobotRock client cannot configure both apiKey and agentService."
+    );
+  }
+  const baseUrl = overrides?.baseUrl ?? getRobotRockApiBaseUrl();
+  const app = overrides?.app ?? process.env.ROBOTROCK_APP;
+  if (agentService) {
+    return app ? { agentService, baseUrl, app } : { agentService, baseUrl };
+  }
+  if (!apiKey) {
+    throw new Error(
+      "RobotRock API key is required. Set ROBOTROCK_API_KEY or pass agentService when creating the client."
+    );
+  }
+  return app ? { apiKey, baseUrl, app } : { apiKey, baseUrl };
+}
+
 // src/eve/agent/cron-chat.ts
 function resolveCronAgentIdentifier(agentIdentifier) {
   return agentIdentifier?.trim() || process.env.ROBOTROCK_CRON_AGENT_IDENTIFIER?.trim() || "robotrock-agent";
@@ -2451,8 +2403,6 @@ function defineRobotRockReadyHook() {
 // src/eve/agent/hooks/chat-audit.ts
 import { defineHook as defineHook2 } from "eve/hooks";
 var loggedIdempotencyKeys = /* @__PURE__ */ new Set();
-var loggedToolCallIds = /* @__PURE__ */ new Set();
-var pendingToolCallsBySession = /* @__PURE__ */ new Map();
 function toEveInputRequest(request) {
   return {
     requestId: request.requestId,
@@ -2462,22 +2412,6 @@ function toEveInputRequest(request) {
     ...request.options ? { options: request.options } : {}
   };
 }
-function stashPendingToolCall(sessionId, callId, toolName, input) {
-  const sessionCalls = pendingToolCallsBySession.get(sessionId) ?? /* @__PURE__ */ new Map();
-  sessionCalls.set(callId, { toolName, input });
-  pendingToolCallsBySession.set(sessionId, sessionCalls);
-}
-function takePendingToolCall(sessionId, callId) {
-  const sessionCalls = pendingToolCallsBySession.get(sessionId);
-  const pending = sessionCalls?.get(callId);
-  if (pending && sessionCalls) {
-    sessionCalls.delete(callId);
-    if (sessionCalls.size === 0) {
-      pendingToolCallsBySession.delete(sessionId);
-    }
-  }
-  return pending;
-}
 async function logPendingInputResponse(ctx, pending, response) {
   const caller = tryResolveTenantCaller(ctx);
   if (!caller) {
@@ -2514,70 +2448,11 @@ async function logPendingInputResponse(ctx, pending, response) {
   });
   loggedIdempotencyKeys.add(idempotencyKey);
 }
-async function logToolExecutionFromResult(ctx, event) {
-  const result = event.data.result;
-  if (result.kind !== "tool-result") {
-    return;
-  }
-  const callId = result.callId;
-  const toolName = result.toolName;
-  if (!callId || !toolName) {
-    return;
-  }
-  const dedupeKey = `${ctx.session.id}:${callId}`;
-  if (loggedToolCallIds.has(dedupeKey)) {
-    return;
-  }
-  const pending = takePendingToolCall(ctx.session.id, callId) ?? { toolName, input: {} };
-  const payload = buildChatToolAuditPayload({
-    toolCallId: callId,
-    toolName: pending.toolName,
-    toolInput: pending.input,
-    status: event.data.status,
-    isError: result.isError,
-    error: event.data.error?.message
-  });
-  if (!payload) {
-    return;
-  }
-  const caller = tryResolveTenantCaller(ctx);
-  if (!caller) {
-    return;
-  }
-  await postRobotRockChatToolAudit(ctx, {
-    eveSessionId: ctx.session.id,
-    userId: caller.userId,
-    toolCallId: payload.toolCallId,
-    toolName: payload.toolName,
-    input: payload.input,
-    success: payload.success,
-    status: payload.status,
-    ...payload.error ? { error: payload.error } : {},
-    idempotencyKey: dedupeKey
-  });
-  loggedToolCallIds.add(dedupeKey);
-}
 function resetRobotrockChatAuditIdempotencyKeys() {
   loggedIdempotencyKeys.clear();
-  loggedToolCallIds.clear();
-  pendingToolCallsBySession.clear();
 }
 var robotrockChatAuditHook = defineHook2({
   events: {
-    async "actions.requested"(event, ctx) {
-      for (const action of event.data.actions) {
-        if (action.kind !== "tool-call") {
-          continue;
-        }
-        const input = action.input != null && typeof action.input === "object" && !Array.isArray(action.input) ? action.input : {};
-        stashPendingToolCall(
-          ctx.session.id,
-          action.callId,
-          action.toolName,
-          input
-        );
-      }
-    },
     async "input.requested"(event, ctx) {
       const requests = [];
       for (const request of event.data.requests) {
@@ -2621,37 +2496,39 @@ var robotrockChatAuditHook = defineHook2({
     },
     async "action.result"(event, ctx) {
       const result = event.data.result;
-      if (result.kind === "tool-result") {
-        const staged = await fetchRobotRockStagedHitl(ctx, ctx.session.id);
-        const pending = staged.find((entry) => entry.toolCallId === result.callId);
-        if (pending) {
-          const idempotencyKey = `${ctx.session.id}:${pending.requestId}`;
-          if (!loggedIdempotencyKeys.has(idempotencyKey)) {
-            if (pending.toolName === "ask_question") {
-              const parsed = parseEveAskQuestionToolOutput(result.output);
-              if (parsed) {
-                await logPendingInputResponse(ctx, pending, {
-                  requestId: pending.requestId,
-                  ...parsed
-                });
-              }
-            } else if (isEveApprovalInputRequest(toEveInputRequest(pending))) {
-              if (event.data.status === "rejected") {
-                await logPendingInputResponse(ctx, pending, {
-                  requestId: pending.requestId,
-                  optionId: "deny"
-                });
-              } else if (event.data.status === "completed") {
-                await logPendingInputResponse(ctx, pending, {
-                  requestId: pending.requestId,
-                  optionId: "approve"
-                });
-              }
-            }
-          }
+      if (result.kind !== "tool-result") {
+        return;
+      }
+      const staged = await fetchRobotRockStagedHitl(ctx, ctx.session.id);
+      const pending = staged.find((entry) => entry.toolCallId === result.callId);
+      if (!pending) {
+        return;
+      }
+      const idempotencyKey = `${ctx.session.id}:${pending.requestId}`;
+      if (loggedIdempotencyKeys.has(idempotencyKey)) {
+        return;
+      }
+      if (pending.toolName === "ask_question") {
+        const parsed = parseEveAskQuestionToolOutput(result.output);
+        if (parsed) {
+          await logPendingInputResponse(ctx, pending, {
+            requestId: pending.requestId,
+            ...parsed
+          });
+        }
+      } else if (isEveApprovalInputRequest(toEveInputRequest(pending))) {
+        if (event.data.status === "rejected") {
+          await logPendingInputResponse(ctx, pending, {
+            requestId: pending.requestId,
+            optionId: "deny"
+          });
+        } else if (event.data.status === "completed") {
+          await logPendingInputResponse(ctx, pending, {
+            requestId: pending.requestId,
+            optionId: "approve"
+          });
         }
       }
-      await logToolExecutionFromResult(ctx, event);
     }
   }
 });
@@ -2671,6 +2548,7 @@ async function agentAdminFetch(config, path, init) {
     headers: {
       "Content-Type": "application/json",
       ...buildRobotRockAuthHeaders(config.auth),
+      ...buildChatCorrelationHeaders(config.chatCorrelation),
       ...init?.headers ?? {}
     }
   });
@@ -2780,13 +2658,23 @@ function createAgentAdminApi(config) {
     }
   };
 }
+function resolveBoundChatCorrelation2(ctx) {
+  const caller = tryResolveTenantCaller(ctx);
+  return {
+    eveSessionId: ctx.session.id,
+    ...caller?.chatId ? { chatId: caller.chatId } : {},
+    ...resolveChatCorrelationFromEnv()
+  };
+}
 function createBoundAgentAdminClient(ctx) {
   const caller = requireTenantCaller(ctx);
   const baseUrl = process.env.ROBOTROCK_BASE_URL?.trim();
   const serviceToken = process.env.ROBOTROCK_AGENT_SERVICE_TOKEN?.trim();
+  const chatCorrelation = resolveBoundChatCorrelation2(ctx);
   if (caller.connectionId && serviceToken) {
     return createAgentAdminApi({
       baseUrl,
+      chatCorrelation,
       auth: resolveRobotRockAuthConfig({
         agentService: {
           token: serviceToken,
@@ -2801,6 +2689,7 @@ function createBoundAgentAdminClient(ctx) {
   if (apiKey) {
     return createAgentAdminApi({
       baseUrl,
+      chatCorrelation,
       auth: {
         kind: "apiKey",
         apiKey,