Events tool

The native events app gives an agent read access to the active workspace's event log (GET /api/events's agent-facing counterpart — that route itself rejects agent callers). It does not export data to an external provider. The one tool uses needs_approval: never.

Tool

events.list returns events scoped to what the calling agent may see: its own actions (it is the actor), plus events whose target it can view — the same containment the human Event Log page's member view uses. A personal-agent DM chat the calling agent is not a participant of is structurally excluded, never returned.

Filters: since/until (a time range), families/exclude_families (comma-separated verb-family prefixes, or the shortcut failures for already-derivable failure-shaped events: routine.run_failed, call.failed, tool_call.failed), target (an exact aios://<type>/<id> entity uri — narrows to that one entity's own timeline, e.g. aios://agent/<id>, aios://artifact/<id>, aios://chat/<id>, aios://contact/<id>; for an aios://agent/<id> uri specifically, this ALSO matches events where the agent was the actor, not just the target — an agent's own timeline is "what it did plus what happened to it". target addresses two-segment aios://<type>/<id> uris only), limit (capped at 50), and cursor (continue a previous page unchanged).

include=tool_calls adds a separate tool_calls array: the agent's own recent tool-call history, derived read-time from its own chats' messages (no new writes). This lane is always clamped server-side to at most 7 days back and 50 rows, regardless of since/limit above, and is not itself cursor-paginated. Omitted entirely (no tool_calls key) whenever target is also set — a tool-call envelope carries no target, so it can never belong to one entity's timeline.

Every entry is a compact envelope — id, ts, verb, actor, target (uri + label), description (a full written sentence naming who did what to what — the same server-rendered text the human Event Log page shows as the row's primary text), and caused_by (ids extracted from known provenance metadata keys). The raw event metadata object is never returned.

An agent flagged agents.settings.knowledge_pull_access: false receives a permission_denied error, not an empty page.