feat(tess): add generic interaction CLI (#731)

apps/gateway/src/agent/tess-durable-session.service.ts

@@ -2,7 +2,10 @@ import { ForbiddenException, Inject, Injectable } from '@nestjs/common';
 import { DurableSessionCoordinator } from '@mosaicstack/agent';
 import type { TessProviderOutboxDto } from './tess-durable-session.dto.js';
 import { TessDurableSessionRepository } from './tess-durable-session.repository.js';
-import { RuntimeProviderService } from './runtime-provider-registry.service.js';
+import {
+  RuntimeProviderService,
+  type RuntimeProviderRequestContext,
+} from './runtime-provider-registry.service.js';
 
 /**
  * Scoped gateway boundary for the canonical Tess state machine. It deliberately
@@ -61,6 +64,19 @@ export class TessDurableSessionService {
     );
   }
 
+  /** Read durable identity/state only after deriving and checking the server-side actor scope. */
+  async getSnapshot(sessionId: string, context: RuntimeProviderRequestContext) {
+    const snapshot = await this.coordinator.snapshot(sessionId);
+    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, {
+      sessionId,
+      content: '',
+      idempotencyKey: 'read-only',
+      correlationId: context.correlationId,
+      context,
+    });
+    return snapshot;
+  }
+
   /** Startup/recovery-only path; normal queue/dispatch methods never requeue live work. */
   async recoverProviderSession(sessionId: string, input: TessProviderOutboxDto): Promise<void> {
     const snapshot = await this.coordinator.snapshot(sessionId);