docs(api): explain safari enum values, add participant access source

Every safari enum value is now named in its description. SessionItem
.access_source gains participant, a value the API actively assigns but
the spec did not list; manager is documented as reserved.

Author: ysyneu

api-reference/openapi.en.json

@@ -50826,7 +50826,7 @@
           },
           "auth_mode": {
             "type": "string",
-            "description": "Authentication mode.",
+            "description": "Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use).",
             "enum": [
               "shared",
               "per_user_secret",
@@ -51110,7 +51110,7 @@
           },
           "environment_kind": {
             "type": "string",
-            "description": "Runtime environment kind. Omit or send an empty value for automatic selection.",
+            "description": "Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (a self-hosted BYOC runner in the account, used with `environment_id`); automatic selection prefers an online BYOC runner and falls back to the cloud sandbox.",
             "enum": [
               "",
               "cloud",
@@ -51206,7 +51206,7 @@
               "person",
               "team"
             ],
-            "description": "Hidden session run scope."
+            "description": "Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id."
           },
           "cron_expr": {
             "type": "string",
@@ -51222,7 +51222,7 @@
           },
           "environment_kind": {
             "type": "string",
-            "description": "Runtime environment kind. Omit or send an empty value for automatic selection.",
+            "description": "Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox).",
             "enum": [
               "",
               "cloud",
@@ -51555,7 +51555,7 @@
               "http_post",
               "oncall_incident"
             ],
-            "description": "Trigger kind."
+            "description": "Trigger kind. One of:\n| Value | Meaning |\n| --- | --- |\n| `schedule` | Fired by the rule's schedule trigger |\n| `debug` | Debug run (reserved; current rule runs never carry this kind) |\n| `manual` | Triggered manually by a user |\n| `http_post` | Fired via the rule's HTTP POST webhook |\n| `oncall_incident` | Fired by an on-call incident event |"
           },
           "occurrence_key": {
             "type": "string",
@@ -51573,7 +51573,7 @@
               "skipped",
               "abandoned"
             ],
-            "description": "Run status."
+            "description": "Run status. One of (the first three are in-flight, the rest terminal):\n| Value | Meaning |\n| --- | --- |\n| `queued` | Enqueued, waiting for a worker |\n| `running` | Executing |\n| `retrying` | An attempt failed and a retry is scheduled |\n| `succeeded` | Completed successfully |\n| `partial` | Partially succeeded (currently only produced by memory-consolidation runs; rule runs never reach it) |\n| `failed` | Terminal failure, no further retries |\n| `skipped` | Not executed (e.g. grace period expired, trigger or rule invalid); the reason is kept on the run record |\n| `abandoned` | Still in-flight past the stale threshold and swept as never-completed (e.g. worker died) |"
           },
           "attempts": {
             "type": "integer",
@@ -51917,7 +51917,7 @@
           },
           "status": {
             "type": "string",
-            "description": "Event status.",
+            "description": "Event status. One of: `normal` (a live event included in the context fed to the model), `compressed` (folded into a compaction summary boundary event; no longer loaded for the model, kept as history only).",
             "enum": [
               "normal",
               "compressed"
@@ -52027,7 +52027,7 @@
           },
           "environment_kind": {
             "type": "string",
-            "description": "Pin the server to a specific BYOC runner (`environment_id` required). Omit or send empty for automatic selection; `cloud` is not supported for MCP servers.",
+            "description": "Pin the server to a specific BYOC runner (`environment_id` required). Omit or send empty for automatic selection; `cloud` is not supported for MCP servers. The only accepted value: `byoc` (a self-hosted BYOC runner in the account; the MCP server process runs on the customer's own infrastructure).",
             "enum": [
               "byoc"
             ]
@@ -52129,7 +52129,7 @@
           },
           "transport": {
             "type": "string",
-            "description": "Transport protocol.",
+            "description": "Transport protocol. One of: `stdio` (standard I/O to a local subprocess), `sse` (standalone SSE, the legacy MCP transport), `streamable-http` (the newer HTTP streaming transport).",
             "enum": [
               "stdio",
               "sse",
@@ -52210,7 +52210,7 @@
           },
           "auth_mode": {
             "type": "string",
-            "description": "Authentication mode.",
+            "description": "Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use).",
             "enum": [
               "shared",
               "per_user_secret",
@@ -52534,7 +52534,7 @@
               "person",
               "team"
             ],
-            "description": "Resolved run scope for this run; mirrors the rule's run_scope."
+            "description": "Resolved run scope for this run; mirrors the rule's run_scope. One of: `person` (personal rule, runs as its creator), `team` (team rule, runs under the owning team)."
           },
           "owner_id": {
             "type": "integer",
@@ -52690,7 +52690,7 @@
           },
           "entry_kind": {
             "type": "string",
-            "description": "Surface that created the session.",
+            "description": "Surface that created the session. One of:\n| Value | Meaning |\n| --- | --- |\n| `web` | Created from the web console |\n| `im` | Created from an IM client (IM bot / IM H5) |\n| `api` | Created via the public API |\n| `automation` | Created by an automation rule (unattended run) |\n| `subagent` | Child session spawned by a parent's agent_dispatch (audit label; at runtime it executes on the web tool surface) |",
             "enum": [
               "web",
               "im",
@@ -52734,12 +52734,13 @@
           },
           "access_source": {
             "type": "string",
-            "description": "How the caller received access to this session. Omitted when no access source is resolved.",
+            "description": "How the caller received access to this session. Omitted when no access source is resolved. One of:\n| Value | Meaning |\n| --- | --- |\n| `owner` | Caller is the session creator (full access) |\n| `team_member` | Caller belongs to the session's bound team (full access) |\n| `manager` | Manager grant (reserved; never produced by the current version) |\n| `share_link` | Granted via a valid share link (view/fork only; cannot continue or manage) |\n| `participant` | Same-account non-member granted via a participable team session (view/continue/fork only) |",
             "enum": [
               "owner",
               "team_member",
               "manager",
-              "share_link"
+              "share_link",
+              "participant"
             ]
           },
           "share_enabled": {
@@ -52763,7 +52764,7 @@
           },
           "status": {
             "type": "string",
-            "description": "Lifecycle status.",
+            "description": "Lifecycle status. One of: `enabled` (active), `deleted` (soft-deleted, no longer accessible).",
             "enum": [
               "enabled",
               "deleted"
@@ -52892,7 +52893,7 @@
         "properties": {
           "app_name": {
             "type": "string",
-            "description": "Agent app whose sessions to list.",
+            "description": "Agent app whose sessions to list. One of:\n| Value | Meaning |\n| --- | --- |\n| `ask-ai` | Ask AI assistant |\n| `support` | Customer-support agent |\n| `support-website` | Website support agent (exposed over A2A, not built into the console) |\n| `support-flashcat` | Flashcat-site support agent (exposed over A2A) |\n| `ai-sre` | The AI SRE main app |\n| `template-assistant` | Notification-template assistant (template editing/validation) |\n| `swe` | Internal benchmarking app (not customer-facing) |",
             "enum": [
               "ask-ai",
               "support",
@@ -58363,7 +58364,7 @@
         "properties": {
           "code": {
             "type": "string",
-            "description": "Warning code.",
+            "description": "Warning code. One of: `unresolved_reference` (an @ref in the written file's content points to a file that does not exist in the pack; `ref` carries it), `still_referenced_by` (the deleted file is still @ref-referenced by other files in the pack; `refs` lists the referrers).",
             "enum": [
               "unresolved_reference",
               "still_referenced_by"
@@ -58404,7 +58405,7 @@
           },
           "scope": {
             "type": "string",
-            "description": "Restrict to one scope; `all` (default) overrides `include_account`.",
+            "description": "Restrict to one scope; `all` (default) overrides `include_account`. One of: `all` (account scope plus visible team scopes), `account` (account-level packs only), `team` (team-level packs only, can be combined with `team_ids`).",
             "enum": [
               "all",
               "account",
@@ -58439,7 +58440,7 @@
         "properties": {
           "scope": {
             "type": "string",
-            "description": "Scope of the pack to ensure.",
+            "description": "Scope of the pack to ensure. One of: `account` (account-level pack; scope_id is forced to the caller's account ID and only account admins may create it; first creation seeds a default DUTY.md), `team` (team-level pack; the `scope_id` team ID is required and the caller must belong to that team).",
             "enum": [
               "account",
               "team"