enh: add API for session event creation

[heerambavi1998]

Summary

add API for session event creation

Changes

How was this tested?

unit tests

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, python/trueforge_sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Medium Risk
New write path for tool-approval and policy events on active turns; enforcement is creator-only and persist-only, but mistakes here affect HITL resume behavior in follow-up work.

Overview
Adds POST /api/v1/sessions/{session_id}/events so clients can batch inbound tip events (user.tool_approval, user.tool_response, user.tool_approval_policy) into the durable session_inbound_events inbox for a given turn_id. The handler is persist-only: it mints id / created_at, writes via insertSessionInboundEvents, and returns the created payloads in request order—no apply, wake, or auto-continue yet.

Access is limited to the session creator (403 otherwise). 404 when the session or turn is missing; 409 when the turn is terminal or an event id collides. OpenAPI, trueforge-core schemas (CreatedSessionEvent, renamed SessionInboundEventItem), the HTTP route/handler, and TS/Python SDK create_event / createEvent are wired up, with unit and wire tests covering happy path, auth, and error cases.

^{Reviewed by Cursor Bugbot for commit 4f61566. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 4f61566

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@truefoundry/trueforge	Patch
@truefoundry/trueforge-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4f61566. Configure here.}

[cursor]

Single-variant policy action oneOf

Low Severity

ToolApprovalPolicyItem.action is emitted as a one-member discriminated oneOf (allow_session only). New public wire schemas must use a plain object alias for a single variant, not a one-member union. Publishing it this way freezes a non-compliant SDK/OpenAPI shape for POST /sessions/{session_id}/events.

Additional Locations (1)

• docs/openapi.json#L4926-L4938

 

^{Triggered by project rule: @truefoundry/trueforge review rules}

^{Reviewed by Cursor Bugbot for commit 4f61566. Configure here.}