@opengeni/api-router 0.7.3 → 0.9.0

package/dist/{chunk-EYYTFA7N.js → chunk-QOYQBYHM.js}

@@ -1,8 +1,9 @@
 // src/app.ts
 import {
+  canonicalizeConfiguredModelId as canonicalizeConfiguredModelId2,
   configuredAllowedModels,
   configuredAllowedReasoningEfforts,
-  configuredModels
+  configuredModels as configuredModels2
 } from "@opengeni/config";
 import {
   ClientConfig,
@@ -23,7 +24,7 @@ import { bodyLimit } from "hono/body-limit";
 import { cors } from "hono/cors";
 import { HTTPException as HTTPException24 } from "hono/http-exception";
 import {
-  hasPermission as hasPermission4,
+  hasPermission as hasPermission5,
   requireAccessGrant as requireAccessGrant17,
   requirePermission,
   requireSessionAuthorization as requireSessionAuthorization3,
@@ -289,11 +290,15 @@ import {
   CreateScheduledTaskRequest,
   defaultRepositoryMountPath,
   SESSION_EVENT_RAW_DELTA_TYPES,
+  SessionEventLatestClass,
   SessionEventPayloadMode,
   SessionEventReadDirection,
   SessionEventReadMode,
+  SessionEventResultMode,
   SessionEventSemanticClass,
   SessionEventType,
+  compactSessionEventResult,
+  sessionEventLatestClassToSemanticClass,
   SessionMcpCredentialUpdateInput,
   VariableSetVariableName,
   UpdateScheduledTaskRequest
@@ -419,7 +424,10 @@ import {
   createSessionForRequest,
   sendAgentSessionMessage,
   steerAgentSession,
-  updateSessionTitle
+  updateSessionTitle,
+  sessionWithEffectiveToolPolicy,
+  workspaceSessionToolPolicyDefaultServerIds,
+  workspaceSessionToolPolicyServerIds
 } from "@opengeni/core";
 import {
   buildFleetContextForSession,
@@ -430,11 +438,70 @@ import {
 } from "@opengeni/core";
 
 // src/mcp/session-view.ts
-import { measureSessionEventJson } from "@opengeni/contracts";
+import {
+  boundSessionEventPayload,
+  measureSessionEventJson,
+  sessionEventJsonBytes
+} from "@opengeni/contracts";
 var SESSION_EVENT_MCP_MAX_BYTES = 64 * 1024;
 var SESSION_EVENT_MCP_FIELD_MAX_CHARS = 4e3;
 var SESSION_DETAIL_MCP_MAX_BYTES = 64 * 1024;
 var RIG_DETAIL_MCP_MAX_BYTES = 64 * 1024;
+function boundSessionEventCompactResult(result, maxBytes = SESSION_EVENT_MCP_MAX_BYTES) {
+  const envelopeMaxBytes = Math.max(8 * 1024, maxBytes);
+  const project = (budget) => {
+    const noValues = budget <= 0;
+    const text = noValues || result.text === null ? null : clampString(result.text, Math.max(128, budget));
+    const boundValue = (value) => noValues || value === null ? null : boundSessionEventPayload(value, {
+      surface: "http_projection",
+      maxBytes: Math.max(1024, budget)
+    });
+    const output = boundValue(result.output);
+    const resultValue = boundValue(result.result);
+    const checkpoint = boundValue(result.checkpoint);
+    const receipt = boundValue(result.receipt);
+    const failure = noValues || result.failure === null ? null : {
+      error: clampString(result.failure.error ?? "", Math.max(128, Math.floor(budget / 3))) || null,
+      code: clampString(result.failure.code ?? "", Math.max(128, Math.floor(budget / 6))) || null,
+      retryable: result.failure.retryable,
+      recovery: clampString(result.failure.recovery ?? "", Math.max(128, Math.floor(budget / 3))) || null
+    };
+    const changed = text !== result.text || output !== result.output || resultValue !== result.result || checkpoint !== result.checkpoint || receipt !== result.receipt || JSON.stringify(failure) !== JSON.stringify(result.failure);
+    const inheritedSourceBoundary = result.truncation.fields.includes("payload");
+    const mcpBoundaryRecorded = changed || inheritedSourceBoundary;
+    const deliveredBytes = sessionEventJsonBytes({
+      text,
+      output,
+      result: resultValue,
+      failure,
+      checkpoint,
+      receipt
+    });
+    return {
+      ...result,
+      text,
+      output,
+      result: resultValue,
+      failure,
+      checkpoint,
+      receipt,
+      truncation: {
+        ...result.truncation,
+        truncated: result.truncation.truncated || changed,
+        fields: mcpBoundaryRecorded ? [.../* @__PURE__ */ new Set([...result.truncation.fields, "mcp_envelope"])] : result.truncation.fields,
+        originalBytes: changed ? result.truncation.originalBytes ?? result.truncation.deliveredBytes : result.truncation.originalBytes,
+        deliveredBytes
+      }
+    };
+  };
+  for (const budget of [12e3, 8e3, 4e3, 2e3, 1e3, 0]) {
+    const candidate = project(budget);
+    if (prettyJsonBytes(candidate) <= envelopeMaxBytes) return candidate;
+  }
+  throw new RangeError(
+    `Session-event compact result exceeds its ${envelopeMaxBytes}-byte envelope`
+  );
+}
 function safeStringify(value) {
   if (typeof value === "string") return value;
   try {
@@ -1985,13 +2052,20 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           },
           authorization?.relatedSessionAccess ?? "root"
         );
-        return json(boundSessionDetailMcp(projected));
+        return json(
+          boundSessionDetailMcp(
+            await withMcpEffectivePolicy(deps, grant.workspaceId, {
+              ...projected,
+              effectiveControl: queue?.effectiveControl ?? projected.effectiveControl
+            })
+          )
+        );
       }
     );
     server.registerTool(
       "session_events",
       {
-        description: "Read a compact semantic tail only when session_get status is insufficient. With no cursor, this returns the newest matching events and excludes raw message/reasoning/command/PTY deltas. Use `latest` as an exclusive lookup for the newest event in exactly one semantic class; it cannot be combined with type or class filters. Use nextBefore to page older or explicit after/nextAfter to page forward. Type/class filters run in the RLS-scoped database query. payloadMode none|summary|full controls retained audit payload projection, but every model result is independently byte-capped with explicit truncation and exact covered sequence bounds. Exact retained forensic payloads require the access-controlled REST/SDK events API with mode=forensic&payloadMode=full; generic source bytes never retained by the audit boundary remain unavailable.",
+        description: "Read a compact semantic tail only when session_get status is insufficient. With no cursor, this returns the newest matching events and excludes raw message/reasoning/command/PTY deltas. Use `latest` as an exclusive lookup for the authoritative newest durable sequence in exactly one semantic class; `receipt` is the concise alias for `tool_receipt`, and latest cannot be combined with type or class filters. Add `resultMode=compact` to latest for one bounded result-bearing completion/checkpoint/receipt without another inference. Use nextBefore to page older or explicit after/nextAfter to page forward. Type/class filters run in the RLS-scoped database query. payloadMode none|summary|full controls retained audit payload projection, but every model result is independently byte-capped with explicit truncation and exact covered sequence bounds. Exact retained forensic payloads require the access-controlled REST/SDK events API with mode=forensic&payloadMode=full; generic source bytes never retained by the audit boundary remain unavailable.",
         inputSchema: {
           sessionId: z4.string().uuid(),
           after: z4.number().int().nonnegative().optional(),
@@ -2000,11 +2074,12 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           direction: z4.enum(SessionEventReadDirection.options).optional(),
           mode: z4.enum(SessionEventReadMode.options).optional(),
           payloadMode: z4.enum(SessionEventPayloadMode.options).optional(),
+          resultMode: z4.enum(SessionEventResultMode.options).optional(),
           includeTypes: z4.array(z4.enum(SessionEventType.options)).max(100).optional(),
           excludeTypes: z4.array(z4.enum(SessionEventType.options)).max(100).optional(),
           includeClasses: z4.array(z4.enum(SessionEventSemanticClass.options)).max(SessionEventSemanticClass.options.length).optional(),
           excludeClasses: z4.array(z4.enum(SessionEventSemanticClass.options)).max(SessionEventSemanticClass.options.length).optional(),
-          latest: z4.enum(SessionEventSemanticClass.options).optional()
+          latest: z4.enum(SessionEventLatestClass.options).optional()
         }
       },
       async ({
@@ -2015,6 +2090,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
         direction: requestedDirection,
         mode: requestedMode,
         payloadMode: requestedPayloadMode,
+        resultMode: requestedResultMode,
         includeTypes,
         excludeTypes,
         includeClasses,
@@ -2022,6 +2098,10 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
         latest
       }) => {
         await authorizeFirstPartySession(deps, grant, sessionId, "session.events.read");
+        const latestClass = latest === void 0 ? void 0 : sessionEventLatestClassToSemanticClass(latest);
+        if (requestedResultMode === "compact" && latestClass === void 0) {
+          throw new Error("resultMode=compact requires latest");
+        }
         await requireSession(deps.db, grant.workspaceId, sessionId);
         if (latest && [includeTypes, excludeTypes, includeClasses, excludeClasses].some(
           (filter) => filter !== void 0
@@ -2029,21 +2109,34 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           throw new Error("latest cannot be combined with event filters");
         }
         const mode = requestedMode ?? (after !== void 0 ? "forensic" : "monitoring");
-        const direction = latest ? "before" : requestedDirection ?? (before !== void 0 ? "before" : after !== void 0 ? "after" : "before");
-        const payloadMode = requestedPayloadMode ?? (mode === "monitoring" ? "summary" : "full");
+        const direction = latestClass ? "before" : requestedDirection ?? (before !== void 0 ? "before" : after !== void 0 ? "after" : "before");
+        const payloadMode = requestedResultMode === "compact" ? "full" : requestedPayloadMode ?? (mode === "monitoring" ? "summary" : "full");
         const dbPage = await listSessionEventPage(deps.db, grant.workspaceId, sessionId, {
           after: after ?? 0,
           ...before !== void 0 ? { before } : {},
           direction,
-          limit: latest ? 1 : boundedSessionEventMcpLimit(limit),
+          limit: latestClass ? 1 : boundedSessionEventMcpLimit(limit),
           payloadMode,
           includeTypes: includeTypes ?? [],
           excludeTypes: excludeTypes ?? [],
-          includeClasses: latest ? [latest] : includeClasses ?? [],
+          includeClasses: latestClass ? [latestClass] : includeClasses ?? [],
           excludeClasses: excludeClasses ?? [],
           ...mode === "monitoring" ? { defaultExcludeTypes: SESSION_EVENT_RAW_DELTA_TYPES } : {},
+          ...latestClass ? { authoritativeLatest: true } : {},
           maxBytes: SESSION_EVENT_MCP_MAX_BYTES * 4
         });
+        if (requestedResultMode === "compact") {
+          const event = dbPage.events[0];
+          return json(
+            event ? boundSessionEventCompactResult(
+              compactSessionEventResult(
+                event,
+                latestClass,
+                dbPage.coveredSequence ?? { first: event.sequence, last: event.sequence }
+              )
+            ) : null
+          );
+        }
         return json(
           boundSessionEventMcpPage({
             events: dbPage.events,
@@ -2143,7 +2236,8 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
         if (callerSessionId !== null) {
           await authorizeFirstPartySession(deps, grant, callerSessionId, "session.child.create");
         }
-        return json(await createSessionForRequest(deps, grant, grant.workspaceId, args));
+        const created = await createSessionForRequest(deps, grant, grant.workspaceId, args);
+        return json(await withMcpEffectivePolicy(deps, grant.workspaceId, created));
       }
     );
   }
@@ -2916,6 +3010,13 @@ function parseMcpDate(raw, label) {
   }
   return date;
 }
+async function withMcpEffectivePolicy(deps, workspaceId, session) {
+  const [workspaceServerIds, workspaceDefaultServerIds] = await Promise.all([
+    workspaceSessionToolPolicyServerIds(deps.db, workspaceId, deps.settings),
+    workspaceSessionToolPolicyDefaultServerIds(deps.db, workspaceId, deps.settings)
+  ]);
+  return sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDefaultServerIds);
+}
 
 // src/mcp/toolspace.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -2931,14 +3032,34 @@ import {
 import {
   buildConnectionTokenResolver,
   buildHostConnectionTokenResolver,
+  clearPendingSessionToolspaceCall,
+  getActiveSessionTurnForExecution,
   getSessionRootId,
-  getSessionTurn as getSessionTurn2,
   listSessionMcpServerMetadata,
   listSessionMcpServersForRun,
+  registerPendingSessionToolCall,
   requireSession as requireSession2,
-  reserveToolspaceCallForTurn
+  reserveToolspaceCallForAttempt
 } from "@opengeni/db";
-import { appendAndPublishEvents as appendAndPublishEvents2 } from "@opengeni/events";
+import { appendAndPublishEvents as appendAndPublishEvents2, appendAndPublishTurnEventsFenced } from "@opengeni/events";
+import { undiciFetch } from "@opengeni/network";
+import {
+  MCP_MAX_AGGREGATE_TOOL_LIST_BYTES,
+  MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES,
+  MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+  MCP_MAX_TOOL_RESULT_BYTES,
+  McpAggregateToolListBudget,
+  McpPayloadTooLargeError,
+  assertMcpPayloadWithinBytes,
+  assertMcpServerSelectionWithinBounds,
+  assertMcpToolListWithinBounds,
+  boundedParallelMap,
+  cancelMcpResponseBody,
+  guardedMcpFetch,
+  mcpSerializedSizeBytes
+} from "@opengeni/runtime/mcp-network";
+import { Buffer as Buffer2 } from "buffer";
+import { createHash } from "crypto";
 var APPROVAL_REQUIRED_MESSAGE = "requires approval - invoke via the agent";
 var TOOLSPACE_AUTH_NEEDED_ERROR_CODE = -32001;
 var TOOLSPACE_AUTH_NEEDED_MESSAGE = "Authentication required - a connection link was posted to the session.";
@@ -2946,16 +3067,91 @@ var TOOLSPACE_NO_ACTIVE_TURN_MESSAGE = "no active turn - toolspace calls require
 var FIRST_PARTY_PROXY_IDS = /* @__PURE__ */ new Set(["files", "docs"]);
 var TOOLSPACE_TOOL_LIST_TTL_MS = 3e4;
 var TOOLSPACE_TOOL_LIST_CACHE_MAX_ENTRIES = 2e3;
-var toolListCache = /* @__PURE__ */ new Map();
+var TOOLSPACE_TOOL_LIST_CACHE_MAX_BYTES = 64 * 1024 * 1024;
+var ToolspaceToolListCache = class {
+  constructor(maxEntries = TOOLSPACE_TOOL_LIST_CACHE_MAX_ENTRIES, maxBytes = TOOLSPACE_TOOL_LIST_CACHE_MAX_BYTES, ttlMs = TOOLSPACE_TOOL_LIST_TTL_MS) {
+    this.maxEntries = maxEntries;
+    this.maxBytes = maxBytes;
+    this.ttlMs = ttlMs;
+    if (maxEntries < 1 || maxBytes < 1 || ttlMs < 1) {
+      throw new Error("toolspace cache limits must be positive");
+    }
+  }
+  values = /* @__PURE__ */ new Map();
+  retainedBytes = 0;
+  read(key, now = Date.now()) {
+    const hit = this.values.get(key);
+    if (!hit) return null;
+    if (hit.expiresAt <= now) {
+      this.delete(key);
+      return null;
+    }
+    this.values.delete(key);
+    this.values.set(key, hit);
+    return hit.entries;
+  }
+  write(key, entries, now = Date.now()) {
+    const sizeBytes = Buffer2.byteLength(key) + mcpSerializedSizeBytes(entries);
+    if (sizeBytes > this.maxBytes) return false;
+    this.delete(key);
+    for (const [existingKey, value] of this.values) {
+      if (value.expiresAt <= now) this.delete(existingKey);
+    }
+    while (this.values.size >= this.maxEntries || this.retainedBytes + sizeBytes > this.maxBytes) {
+      const oldestKey = this.values.keys().next().value;
+      if (oldestKey === void 0) break;
+      this.delete(oldestKey);
+    }
+    this.values.set(key, { expiresAt: now + this.ttlMs, entries, sizeBytes });
+    this.retainedBytes += sizeBytes;
+    return true;
+  }
+  clear() {
+    this.values.clear();
+    this.retainedBytes = 0;
+  }
+  snapshot() {
+    return {
+      entries: this.values.size,
+      bytes: this.retainedBytes,
+      keys: [...this.values.keys()]
+    };
+  }
+  delete(key) {
+    const existing = this.values.get(key);
+    if (!existing) return;
+    this.values.delete(key);
+    this.retainedBytes -= existing.sizeBytes;
+  }
+};
+var toolListCache = new ToolspaceToolListCache();
+function toolspaceAuthorityForGrant(grant) {
+  const sessionId = grant.metadata?.sessionId;
+  return typeof sessionId === "string" ? { sessionId } : null;
+}
 function isToolspaceGrant(settings, grant) {
-  return settings.toolspaceEnabled && hasPermission2(grant.permissions, "toolspace:call") && typeof grant.metadata?.sessionId === "string";
+  return settings.toolspaceEnabled && hasPermission2(grant.permissions, "toolspace:call") && toolspaceAuthorityForGrant(grant) !== null;
 }
 async function prepareToolspaceMcpSurface(input) {
   const { deps, grant } = input;
   if (!isToolspaceGrant(deps.settings, grant)) {
     return null;
   }
-  const sessionId = grant.metadata.sessionId;
+  const authority = toolspaceAuthorityForGrant(grant);
+  if (!authority) {
+    return null;
+  }
+  const { sessionId } = authority;
+  const activeTurn = await getActiveSessionTurnForExecution(deps.db, grant.workspaceId, sessionId);
+  if (!activeTurn?.activeAttemptId || activeTurn.status !== "running") {
+    return emptyToolspaceSurface(sessionId, grant.subjectId);
+  }
+  const attemptAuthority = {
+    sessionId,
+    turnId: activeTurn.id,
+    attemptId: activeTurn.activeAttemptId,
+    executionGeneration: activeTurn.executionGeneration
+  };
   const session = await requireSession2(deps.db, grant.workspaceId, sessionId);
   let rootSessionId = sessionId;
   if (deps.connectionCredentials?.mcpCredentials) {
@@ -2970,22 +3166,38 @@ async function prepareToolspaceMcpSurface(input) {
     session.mcpServers.map((server) => server.id)
   );
   const proxyableIds = [...selectedIds].filter((id) => toolspaceCanProxyServerId(id));
+  assertMcpServerSelectionWithinBounds(proxyableIds);
   if (proxyableIds.length === 0) {
     return emptyToolspaceSurface(sessionId, grant.subjectId);
   }
-  let registryPromise = null;
-  const getRegistry = () => registryPromise ??= buildToolspaceRegistry(deps, grant.workspaceId, sessionId);
+  const registryPromises = /* @__PURE__ */ new Map();
+  const getRegistry = (attemptId) => {
+    const existing = registryPromises.get(attemptId);
+    if (existing) {
+      return existing;
+    }
+    const created = buildToolspaceRegistry(deps, grant.workspaceId, sessionId, attemptId);
+    registryPromises.set(attemptId, created);
+    return created;
+  };
   const listing = await resolveToolListing({
     deps,
     grant,
     sessionId,
     rootSessionId,
     proxyableIds,
-    activeTurnId: session.activeTurnId ?? null,
-    getRegistry
+    activeTurn,
+    getRegistry: () => getRegistry(attemptAuthority.attemptId)
   });
   const tools = listing.map(
-    (entry) => toolspaceToolFor({ deps, grant, sessionId, rootSessionId, entry, getRegistry })
+    (entry) => toolspaceToolFor({
+      deps,
+      grant,
+      authority: attemptAuthority,
+      rootSessionId,
+      entry,
+      getRegistry
+    })
   );
   return {
     sessionId,
@@ -3001,7 +3213,7 @@ function emptyToolspaceSurface(sessionId, subjectId) {
   return { sessionId, subjectId, tools: [], close: async () => {
   } };
 }
-async function buildToolspaceRegistry(deps, workspaceId, sessionId) {
+async function buildToolspaceRegistry(deps, workspaceId, sessionId, attemptId) {
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     deps.db,
     workspaceId,
@@ -3011,19 +3223,13 @@ async function buildToolspaceRegistry(deps, workspaceId, sessionId) {
     deps,
     workspaceId,
     sessionId,
+    attemptId,
     runtimeSettings
   );
   return new Map(withSessionServers.mcpServers.map((server) => [server.id, server]));
 }
 async function resolveToolListing(input) {
-  const { deps, grant, sessionId, rootSessionId, proxyableIds, activeTurnId, getRegistry } = input;
-  if (!activeTurnId) {
-    return [];
-  }
-  const activeTurn = await getSessionTurn2(deps.db, grant.workspaceId, activeTurnId);
-  if (!activeTurn || activeTurn.sessionId !== sessionId) {
-    return [];
-  }
+  const { deps, grant, sessionId, rootSessionId, proxyableIds, activeTurn, getRegistry } = input;
   const cacheKey = await toolListCacheKey(
     deps,
     grant.workspaceId,
@@ -3036,11 +3242,17 @@ async function resolveToolListing(input) {
     return cached;
   }
   const registry = await getRegistry();
+  const aggregateBudget = new McpAggregateToolListBudget(
+    "aggregate Toolspace tool list",
+    MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES,
+    MCP_MAX_AGGREGATE_TOOL_LIST_BYTES
+  );
   const entries = [];
-  for (const serverId of proxyableIds) {
+  await boundedParallelMap(proxyableIds, MCP_MAX_CONCURRENT_SERVER_OPERATIONS, async (serverId) => {
     const config = registry.get(serverId);
     if (!config || !toolspaceCanProxyServer(config)) {
-      continue;
+      aggregateBudget.replace(serverId, []);
+      return;
     }
     const connection = await connectToolspaceServer({
       deps,
@@ -3051,20 +3263,33 @@ async function resolveToolListing(input) {
       turn: activeTurn
     }).catch(() => null);
     if (!connection) {
-      continue;
+      aggregateBudget.replace(serverId, []);
+      return;
     }
     try {
       const listed = await connection.client.listTools(void 0, toolspaceRequestOptions(config)).catch(() => ({ tools: [] }));
-      for (const tool of listed.tools) {
-        if (!tool?.name || !allowedByConfig(config, tool.name)) {
-          continue;
-        }
-        entries.push({ serverId, tool, requireApproval: config.requireApproval });
-      }
+      let boundedTools;
+      try {
+        boundedTools = assertMcpToolListWithinBounds(listed.tools);
+      } catch (error) {
+        deps.observability?.warn("toolspace upstream tool list exceeded safety limit", {
+          serverId,
+          errorClass: error instanceof Error ? error.name : typeof error
+        });
+        aggregateBudget.replace(serverId, []);
+        return;
+      }
+      const sourceEntries = boundedTools.filter((tool) => Boolean(tool?.name) && allowedByConfig(config, tool.name)).map((tool) => ({
+        serverId,
+        tool,
+        requireApproval: config.requireApproval
+      }));
+      aggregateBudget.replace(serverId, sourceEntries);
+      entries.push(...sourceEntries);
     } finally {
       await connection.close();
     }
-  }
+  });
   writeToolListCache(cacheKey, entries);
   return entries;
 }
@@ -3075,36 +3300,18 @@ async function toolListCacheKey(deps, workspaceId, sessionId, proxyableIds, turn
   const authority = JSON.stringify({
     turnId: turn.id,
     executionGeneration: turn.executionGeneration,
+    attemptId: turn.activeAttemptId,
     initiator: turn.initiator
   });
   return `${workspaceId}:${sessionId}:${signature}:${authority}`;
 }
 function readToolListCache(key) {
-  const hit = toolListCache.get(key);
-  if (!hit) {
-    return null;
-  }
-  if (hit.expiresAt <= Date.now()) {
-    toolListCache.delete(key);
-    return null;
-  }
-  return hit.entries;
+  return toolListCache.read(key);
 }
 function writeToolListCache(key, entries) {
-  if (toolListCache.size >= TOOLSPACE_TOOL_LIST_CACHE_MAX_ENTRIES) {
-    const now = Date.now();
-    for (const [existingKey, value] of toolListCache) {
-      if (value.expiresAt <= now) {
-        toolListCache.delete(existingKey);
-      }
-    }
-    if (toolListCache.size >= TOOLSPACE_TOOL_LIST_CACHE_MAX_ENTRIES) {
-      toolListCache.clear();
-    }
-  }
-  toolListCache.set(key, { expiresAt: Date.now() + TOOLSPACE_TOOL_LIST_TTL_MS, entries });
+  toolListCache.write(key, entries);
 }
-async function settingsWithSessionMcpServersForToolspace(deps, workspaceId, sessionId, settings) {
+async function settingsWithSessionMcpServersForToolspace(deps, workspaceId, sessionId, attemptId, settings) {
   const encryptionKey = environmentsEncryptionKeyBytes(settings);
   if (!encryptionKey) {
     const metadata = await listSessionMcpServerMetadata(deps.db, workspaceId, sessionId);
@@ -3121,6 +3328,7 @@ async function settingsWithSessionMcpServersForToolspace(deps, workspaceId, sess
     deps.db,
     workspaceId,
     sessionId,
+    attemptId,
     encryptionKey ?? null
   );
   if (servers.length === 0) {
@@ -3146,7 +3354,8 @@ async function settingsWithSessionMcpServersForToolspace(deps, workspaceId, sess
   };
 }
 async function connectToolspaceServer(input) {
-  const baseFetch = input.config.connectionRef ? connectionBrokerFetch(globalThis.fetch, input) : globalThis.fetch;
+  const guardedFetch = guardedMcpFetch(input.deps.settings, undiciFetch);
+  const baseFetch = input.config.connectionRef ? connectionBrokerFetch(guardedFetch, input) : guardedFetch;
   const client = new Client(
     { name: `opengeni-toolspace-${input.config.id}`, version: "1.0.0" },
     { capabilities: {} }
@@ -3157,7 +3366,12 @@ async function connectToolspaceServer(input) {
       headers: toolspaceServerHeaders(input.config)
     }
   });
-  await client.connect(transport, toolspaceRequestOptions(input.config));
+  try {
+    await client.connect(transport, toolspaceRequestOptions(input.config));
+  } catch (error) {
+    await client.close().catch(() => void 0);
+    throw error;
+  }
   return {
     config: input.config,
     client,
@@ -3167,7 +3381,8 @@ async function connectToolspaceServer(input) {
   };
 }
 function toolspaceToolFor(input) {
-  const { deps, grant, sessionId, rootSessionId, entry, getRegistry } = input;
+  const { deps, grant, authority, rootSessionId, entry, getRegistry } = input;
+  const { sessionId } = authority;
   const { serverId, tool } = entry;
   const name = prefixedMcpToolName(serverId, tool.name);
   const approvalRequired = mcpToolRequiresApproval(entry.requireApproval, tool.name);
@@ -3177,10 +3392,7 @@ function toolspaceToolFor(input) {
     ...description ? { description } : {},
     ...tool.inputSchema ? { inputSchema: tool.inputSchema } : {},
     call: async (args) => {
-      if (approvalRequired) {
-        return mcpError(APPROVAL_REQUIRED_MESSAGE);
-      }
-      const reservation = await reserveActiveTurnCall(deps, grant.workspaceId, sessionId);
+      const reservation = await reserveExactAttemptCall(deps, grant, authority);
       if (reservation.status === "no_active_turn") {
         return mcpError(TOOLSPACE_NO_ACTIVE_TURN_MESSAGE);
       }
@@ -3190,7 +3402,7 @@ function toolspaceToolFor(input) {
         );
       }
       const turnId = reservation.turn.id;
-      const registry = await getRegistry();
+      const registry = await getRegistry(authority.attemptId);
       const config = registry.get(serverId);
       if (!config || !toolspaceCanProxyServer(config) || !allowedByConfig(config, tool.name)) {
         return mcpError(`upstream tool failed: ${name}`);
@@ -3211,39 +3423,91 @@ function toolspaceToolFor(input) {
       }
       try {
         const callId = crypto.randomUUID();
-        await appendAndPublishEvents2(deps.db, deps.bus, grant.workspaceId, sessionId, [
-          {
-            type: "agent.toolCall.created",
-            turnId,
-            producerId: grant.subjectId,
-            payload: {
-              id: callId,
-              name,
-              arguments: args,
-              origin: "toolspace",
-              subjectId: grant.subjectId,
-              raw: {
-                type: "toolspace_call",
-                serverId,
-                toolName: tool.name
+        const receipt = {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          sessionId,
+          turnId,
+          executionGeneration: authority.executionGeneration,
+          attemptId: authority.attemptId,
+          callId
+        };
+        const registered = await registerPendingSessionToolCall(deps.db, {
+          ...receipt,
+          callType: "toolspace_call",
+          callItem: {
+            type: "toolspace_call",
+            id: callId,
+            name,
+            arguments: toolspaceAuditSummary(args),
+            serverId,
+            toolName: tool.name
+          }
+        });
+        if (!registered.accepted || !registered.registered) {
+          return mcpError(TOOLSPACE_NO_ACTIVE_TURN_MESSAGE);
+        }
+        const created = await appendAndPublishTurnEventsFenced(
+          deps.db,
+          deps.bus,
+          grant.workspaceId,
+          sessionId,
+          turnId,
+          authority.executionGeneration,
+          authority.attemptId,
+          [
+            {
+              type: "agent.toolCall.created",
+              turnId,
+              turnGeneration: authority.executionGeneration,
+              turnAttemptId: authority.attemptId,
+              producerId: grant.subjectId,
+              payload: {
+                id: callId,
+                name,
+                arguments: args,
+                origin: "toolspace",
+                subjectId: grant.subjectId,
+                raw: {
+                  type: "toolspace_call",
+                  serverId,
+                  toolName: tool.name
+                }
               }
             }
-          }
-        ]);
+          ]
+        );
+        if (!created.accepted) {
+          return mcpError(TOOLSPACE_NO_ACTIVE_TURN_MESSAGE);
+        }
         const output = await callRemoteTool(deps, connection, tool.name, args);
-        await appendAndPublishEvents2(deps.db, deps.bus, grant.workspaceId, sessionId, [
-          {
-            type: "agent.toolCall.output",
-            turnId,
-            producerId: grant.subjectId,
-            payload: {
-              id: callId,
-              output,
-              origin: "toolspace",
-              subjectId: grant.subjectId
+        const completed = await appendAndPublishTurnEventsFenced(
+          deps.db,
+          deps.bus,
+          grant.workspaceId,
+          sessionId,
+          turnId,
+          authority.executionGeneration,
+          authority.attemptId,
+          [
+            {
+              type: "agent.toolCall.output",
+              turnId,
+              turnGeneration: authority.executionGeneration,
+              turnAttemptId: authority.attemptId,
+              producerId: grant.subjectId,
+              payload: {
+                id: callId,
+                output: toolspaceAuditSummary(output),
+                origin: "toolspace",
+                subjectId: grant.subjectId
+              }
             }
-          }
-        ]);
+          ]
+        );
+        if (completed.accepted) {
+          await clearPendingSessionToolspaceCall(deps.db, receipt);
+        }
         return output;
       } finally {
         await connection.close();
@@ -3253,7 +3517,7 @@ function toolspaceToolFor(input) {
 }
 async function callRemoteTool(deps, server, toolName, args) {
   try {
-    return await server.client.callTool(
+    const output = await server.client.callTool(
       {
         name: toolName,
         arguments: args
@@ -3261,7 +3525,17 @@ async function callRemoteTool(deps, server, toolName, args) {
       void 0,
       toolspaceRequestOptions(server.config)
     );
+    assertMcpPayloadWithinBytes(output, MCP_MAX_TOOL_RESULT_BYTES, "MCP tool result");
+    return output;
   } catch (error) {
+    if (error instanceof McpPayloadTooLargeError) {
+      deps.observability?.warn("toolspace upstream tool result exceeded safety limit", {
+        serverId: server.config.id,
+        toolName,
+        errorClass: error.name
+      });
+      return mcpError("upstream tool result exceeded the safety limit");
+    }
     if (isToolspaceAuthNeededError(error)) {
       return mcpError(TOOLSPACE_AUTH_NEEDED_MESSAGE);
     }
@@ -3273,23 +3547,33 @@ async function callRemoteTool(deps, server, toolName, args) {
     return mcpError(`upstream tool failed: ${prefixedMcpToolName(server.config.id, toolName)}`);
   }
 }
-async function reserveActiveTurnCall(deps, workspaceId, sessionId) {
-  const session = await requireSession2(deps.db, workspaceId, sessionId);
-  if (!session.activeTurnId) {
-    return { status: "no_active_turn" };
+function toolspaceAuditSummary(value) {
+  let serialized;
+  try {
+    serialized = JSON.stringify(value) ?? "null";
+  } catch {
+    serialized = "[unserializable]";
   }
-  const reservation = await reserveToolspaceCallForTurn(
-    deps.db,
-    workspaceId,
-    sessionId,
-    session.activeTurnId,
-    deps.settings.toolspaceMaxCallsPerTurn
-  );
+  return {
+    redacted: true,
+    sizeBytes: Buffer2.byteLength(serialized),
+    sha256: createHash("sha256").update(serialized).digest("hex")
+  };
+}
+async function reserveExactAttemptCall(deps, grant, authority) {
+  const reservation = await reserveToolspaceCallForAttempt(deps.db, {
+    accountId: grant.accountId,
+    workspaceId: grant.workspaceId,
+    sessionId: authority.sessionId,
+    turnId: authority.turnId,
+    executionGeneration: authority.executionGeneration,
+    attemptId: authority.attemptId,
+    limit: deps.settings.toolspaceMaxCallsPerTurn
+  });
   if (!reservation.reserved) {
-    return { status: "budget_exhausted" };
+    return reservation.reason === "budget_exhausted" ? { status: "budget_exhausted" } : { status: "no_active_turn" };
   }
-  const turn = await getSessionTurn2(deps.db, workspaceId, session.activeTurnId);
-  return turn && turn.sessionId === sessionId ? { status: "ok", turn } : { status: "no_active_turn" };
+  return { status: "ok", turn: reservation.turn };
 }
 function selectedMcpServerIds(tools, sessionServerIds) {
   const out = new Set(sessionServerIds);
@@ -3331,6 +3615,9 @@ function mcpError(message) {
 function toolspaceRequestOptions(config) {
   return config.timeoutMs ? { timeout: config.timeoutMs, maxTotalTimeout: config.timeoutMs } : {};
 }
+function mcpRequestDestinationUrl(input) {
+  return new URL(input instanceof Request ? input.url : input.toString()).toString();
+}
 function connectionBrokerFetch(baseFetch, input) {
   const connectionRef = input.config.connectionRef;
   if (!connectionRef) {
@@ -3350,10 +3637,12 @@ function connectionBrokerFetch(baseFetch, input) {
   }) : buildConnectionTokenResolver(input.deps.db, input.deps.settings);
   return async (requestInput, init) => {
     const request = await mcpRequestInfo(requestInput, init);
+    const destinationUrl = mcpRequestDestinationUrl(requestInput);
     const first = await resolveCredential({
       workspaceId: input.grant.workspaceId,
       serverId: input.config.id,
       connectionRef,
+      destinationUrl,
       forceRefresh: false,
       ...request.toolName ? { toolName: request.toolName } : {},
       subjectId: input.grant.subjectId
@@ -3366,10 +3655,12 @@ function connectionBrokerFetch(baseFetch, input) {
       withConnectionHeaders(requestInput, init, first.headers)
     );
     if (response.status === 401) {
+      await cancelMcpResponseBody(response);
       const refreshed = await resolveCredential({
         workspaceId: input.grant.workspaceId,
         serverId: input.config.id,
         connectionRef,
+        destinationUrl,
         forceRefresh: true,
         ...request.toolName ? { toolName: request.toolName } : {},
         subjectId: input.grant.subjectId
@@ -3377,12 +3668,30 @@ function connectionBrokerFetch(baseFetch, input) {
       if (refreshed.status === "auth_needed") {
         return await authNeededFetchResponse(input, request, refreshed);
       }
-      return await baseFetch(
+      const retry = await baseFetch(
         fetchInputForAttempt(requestInput),
         withConnectionHeaders(requestInput, init, refreshed.headers)
       );
+      if (retry.status === 401) {
+        await cancelMcpResponseBody(retry);
+        return await authNeededFetchResponse(
+          input,
+          request,
+          authNeededFromStatus(input.config, refreshed, "expired")
+        );
+      }
+      if (retry.status === 403) {
+        await cancelMcpResponseBody(retry);
+        return await authNeededFetchResponse(
+          input,
+          request,
+          authNeededFromStatus(input.config, refreshed, "insufficient_scope")
+        );
+      }
+      return retry;
     }
     if (response.status === 403) {
+      await cancelMcpResponseBody(response);
       return await authNeededFetchResponse(
         input,
         request,
@@ -3449,8 +3758,8 @@ async function authNeededFetchResponse(input, request, auth) {
   }
   return new Response("Authentication required for MCP server connection", { status: 401 });
 }
-async function mcpRequestInfo(_input, init) {
-  const body = typeof init?.body === "string" ? init.body : "";
+async function mcpRequestInfo(input, init) {
+  const body = typeof init?.body === "string" ? init.body : input instanceof Request && (init?.method ?? input.method).toUpperCase() === "POST" ? await input.clone().text().catch(() => "") : "";
   if (!body) {
     return {};
   }
@@ -3468,20 +3777,25 @@ async function mcpRequestInfo(_input, init) {
     return {};
   }
 }
-function withConnectionHeaders(_input, init, authHeaders) {
-  const headers = new Headers(init?.headers);
+function withConnectionHeaders(input, init, authHeaders) {
+  const headers = new Headers(
+    init?.headers ?? (input instanceof Request ? input.headers : void 0)
+  );
   for (const [name, value] of Object.entries(authHeaders)) {
     headers.set(name, value);
   }
   return { ...init, headers };
 }
 function fetchInputForAttempt(input) {
-  return input;
+  return input instanceof Request ? input.clone() : input;
 }
 function isToolspaceAuthNeededError(error) {
   return error instanceof Error && (error.code === TOOLSPACE_AUTH_NEEDED_ERROR_CODE || error.message.includes(TOOLSPACE_AUTH_NEEDED_MESSAGE));
 }
 
+// src/app.ts
+import { boundedMcpRequest, McpPayloadTooLargeError as McpPayloadTooLargeError2 } from "@opengeni/runtime/mcp-network";
+
 // src/routes/install.ts
 import { readFile, stat } from "fs/promises";
 import { HTTPException } from "hono/http-exception";
@@ -3814,8 +4128,8 @@ function registerCatalogAssetRoutes(app, deps) {
     if (!contentType) {
       throw new HTTPException3(404, { message: "asset not found" });
     }
-    const object3 = await objectStorage.getObjectBytes(key);
-    if (!object3) {
+    const object4 = await objectStorage.getObjectBytes(key);
+    if (!object4) {
       throw new HTTPException3(404, { message: "asset not found" });
     }
     const etag = etagForKey(key);
@@ -3828,7 +4142,7 @@ function registerCatalogAssetRoutes(app, deps) {
     if (ifNoneMatchSatisfied(c.req.header("if-none-match"), etag)) {
       return c.body(null, 304, headers);
     }
-    return c.body(new Uint8Array(object3.bytes), 200, { ...headers, "Content-Type": contentType });
+    return c.body(new Uint8Array(object4.bytes), 200, { ...headers, "Content-Type": contentType });
   });
 }
 function catalogAssetKeyFromPath(pathname) {
@@ -3880,6 +4194,7 @@ import {
   CODEX_PROVIDER_ID,
   CODEX_WEEKLY_WINDOW_SECONDS,
   CodexDeviceError,
+  consumeCodexRateLimitResetCredit,
   exchangeDeviceCode,
   fetchCodexModels,
   parseIdToken,
@@ -3887,15 +4202,26 @@ import {
   startDeviceCode
 } from "@opengeni/codex";
 import {
+  abandonCodexResetRedemptionBeforeProvider,
+  adoptCodexResetRedemptionAttempt,
+  buildCodexTokenResolver,
+  claimCodexResetRedemption,
+  completeCodexResetRedemption,
   disconnectAllCodexAccounts,
   disconnectCodexAccount,
   encryptEnvironmentValue,
   ensureCodexRotationSettings,
   fetchCodexUsageForAccount,
+  fetchCodexRateLimitResetCreditsForAccount,
+  fenceCodexResetRedemptionSend,
+  getCodexResetRedemptionAttempt,
   getCodexCredentialStatus,
   getCodexRotationSettings,
   listPendingCodexCapacityWakeTargets,
   listCodexAccountStatuses,
+  listCodexResetRedemptionRecoveries,
+  releaseCodexResetRedemptionClaim,
+  updateCodexAllocatorEligibility,
   loadCodexCredentialForRun,
   renameCodexAccount,
   setActiveCodexCredential,
@@ -3905,8 +4231,70 @@ import {
   withCodexCapacityMutation
 } from "@opengeni/db";
 import { createSignedState, readSignedState } from "@opengeni/github";
+import { hasPermission as hasPermission3, requireAccessGrant as requireAccessGrant2 } from "@opengeni/core";
 import { HTTPException as HTTPException4 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant2 } from "@opengeni/core";
+import * as z from "zod/v4";
+
+// src/codex-redemption-security.ts
+var encoder = new TextEncoder();
+function base64UrlEncode(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+function base64UrlDecode(value) {
+  try {
+    return new Uint8Array(Buffer.from(value, "base64url"));
+  } catch {
+    return null;
+  }
+}
+async function hmac(secret, payload) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(payload)));
+}
+function constantTimeEqual2(left, right) {
+  if (left.length !== right.length) return false;
+  let diff = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    diff |= left[index] ^ right[index];
+  }
+  return diff === 0;
+}
+async function hashCodexBrowserSession(sessionId) {
+  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(sessionId));
+  return base64UrlEncode(new Uint8Array(digest));
+}
+async function signCodexRedemptionConfirmation(secret, claims) {
+  const payload = base64UrlEncode(encoder.encode(JSON.stringify(claims)));
+  return `${payload}.${base64UrlEncode(await hmac(secret, payload))}`;
+}
+async function verifyCodexRedemptionConfirmation(secret, token, now = Date.now()) {
+  const [payload, signature, extra] = token.split(".");
+  if (!payload || !signature || extra !== void 0) return null;
+  const supplied = base64UrlDecode(signature);
+  const encodedClaims = base64UrlDecode(payload);
+  if (!supplied || !encodedClaims) return null;
+  if (!constantTimeEqual2(supplied, await hmac(secret, payload))) return null;
+  let claims;
+  try {
+    claims = JSON.parse(new TextDecoder().decode(encodedClaims));
+  } catch {
+    return null;
+  }
+  if (!claims || typeof claims !== "object") return null;
+  const value = claims;
+  if (value.version !== 1 || typeof value.attemptId !== "string" || typeof value.workspaceId !== "string" || typeof value.credentialId !== "string" || typeof value.creditId !== "string" || typeof value.subjectId !== "string" || typeof value.browserSessionHash !== "string" || typeof value.expiresAt !== "number" || !Number.isFinite(value.expiresAt) || value.expiresAt * 1e3 <= now) {
+    return null;
+  }
+  return value;
+}
+
+// src/routes/codex.ts
 var CODEX_PROVIDER_LABEL = "Codex subscription \xB7 no credits";
 function codexAccountJson(row) {
   return {
@@ -3931,6 +4319,11 @@ function codexAccountJson(row) {
       CODEX_WEEKLY_WINDOW_SECONDS
     ),
     usageCheckedAt: row.usageCheckedAt,
+    allocatorEnabled: row.allocatorEnabled,
+    allocatorVersion: row.allocatorVersion,
+    allocatorUpdatedAt: row.allocatorUpdatedAt,
+    resetCreditAvailableCount: row.resetCreditAvailableCount,
+    resetCreditsCheckedAt: row.resetCreditsCheckedAt,
     // P3 rotation cooldown: when set and in the future, this account is cooling-down.
     exhaustedUntil: row.exhaustedUntil
   };
@@ -3952,6 +4345,240 @@ function codexModelsForPicker(liveSlugs) {
     api: "responses"
   }));
 }
+var CODEX_OVERVIEW_STALE_MS = 15 * 6e4;
+var CODEX_REDEMPTION_CONFIRMATION_SECONDS = 5 * 60;
+var CODEX_REDEMPTION_CONFIRMATION = "REDEEM_USAGE_LIMIT_RESET";
+var redemptionPrepareBody = z.object({
+  attemptId: z.string().uuid(),
+  creditId: z.string().min(1).max(1024)
+});
+var redemptionBody = redemptionPrepareBody.extend({
+  confirmationToken: z.string().min(1).max(8192),
+  confirmation: z.literal(CODEX_REDEMPTION_CONFIRMATION)
+});
+async function managedCookieHuman(c, deps) {
+  if (deps.settings.productAccessMode !== "managed" || !deps.managedAuth || !c.req.header("cookie") || c.req.header("authorization")) {
+    return null;
+  }
+  const session = await deps.managedAuth.api.getSession({
+    headers: c.req.raw.headers
+  });
+  if (!session?.user?.id || !session.session?.id) return null;
+  return {
+    subjectId: `user:${session.user.id}`,
+    browserSessionHash: await hashCodexBrowserSession(session.session.id)
+  };
+}
+function requireSameOriginBrowserMutation(c, deps) {
+  const contentType = c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (contentType !== "application/json") {
+    throw new HTTPException4(403, {
+      message: "JSON browser request required"
+    });
+  }
+  if (!deps.settings.publicBaseUrl) {
+    throw new HTTPException4(503, {
+      message: "managed browser origin is not configured"
+    });
+  }
+  const expectedOrigin = new URL(deps.settings.publicBaseUrl).origin;
+  if (c.req.header("origin") !== expectedOrigin) {
+    throw new HTTPException4(403, {
+      message: "same-origin browser request required"
+    });
+  }
+  if (c.req.header("sec-fetch-site")?.toLowerCase() !== "same-origin") {
+    throw new HTTPException4(403, {
+      message: "same-origin fetch metadata required"
+    });
+  }
+}
+async function requireRedemptionHuman(c, deps, workspaceId) {
+  if (deps.settings.productAccessMode !== "managed") {
+    throw new HTTPException4(403, {
+      message: "reset redemption requires managed product mode"
+    });
+  }
+  if (c.req.header("authorization")) {
+    throw new HTTPException4(403, {
+      message: "authorization bearer is not allowed for redemption"
+    });
+  }
+  requireSameOriginBrowserMutation(c, deps);
+  const human = await managedCookieHuman(c, deps);
+  if (!human) {
+    throw new HTTPException4(401, {
+      message: "managed browser session required"
+    });
+  }
+  const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+  if (grant.subjectId !== human.subjectId) {
+    throw new HTTPException4(403, {
+      message: "managed browser identity mismatch"
+    });
+  }
+  return { human, accountId: grant.accountId };
+}
+function cachedUsage(row) {
+  const fiveHour = buildCodexUsageWindowFromCache(
+    row.primaryUsedPercent,
+    row.primaryResetAt,
+    CODEX_FIVE_HOUR_WINDOW_SECONDS
+  );
+  const weekly = buildCodexUsageWindowFromCache(
+    row.secondaryUsedPercent,
+    row.secondaryResetAt,
+    CODEX_WEEKLY_WINDOW_SECONDS
+  );
+  if (!fiveHour && !weekly && row.resetCreditAvailableCount == null) return null;
+  const limitReached = (fiveHour?.percent ?? 0) >= 100 || (weekly?.percent ?? 0) >= 100;
+  return {
+    status: limitReached ? "limit_reached" : fiveHour || weekly ? "ok" : "no-data",
+    planType: row.planType,
+    fiveHour,
+    weekly,
+    limitReached,
+    fetchedAt: (row.usageCheckedAt ?? row.resetCreditsCheckedAt ?? /* @__PURE__ */ new Date(0)).toISOString(),
+    rateLimitResetCredits: row.resetCreditAvailableCount == null ? null : { availableCount: row.resetCreditAvailableCount, credits: null }
+  };
+}
+function staleAt(value) {
+  return !value || Date.now() - value.getTime() > CODEX_OVERVIEW_STALE_MS;
+}
+function sortedCredits(credits) {
+  return [...credits].sort((left, right) => {
+    if (left.expiresAt == null && right.expiresAt == null) return left.id.localeCompare(right.id);
+    if (left.expiresAt == null) return 1;
+    if (right.expiresAt == null) return -1;
+    return left.expiresAt - right.expiresAt || left.id.localeCompare(right.id);
+  });
+}
+function actionableCredit(credit, nowSeconds = Date.now() / 1e3) {
+  return credit.resetType === "codexRateLimits" && credit.status === "available" && (credit.expiresAt == null || credit.expiresAt > nowSeconds);
+}
+function freshActionableCredit(details, creditId) {
+  const availableDetailCount = details.credits.filter(
+    (credit2) => credit2.status === "available"
+  ).length;
+  if (details.availableCount !== availableDetailCount || details.credits.some((credit2) => credit2.resetType === "unknown" || credit2.status === "unknown")) {
+    return null;
+  }
+  const credit = details.credits.find((candidate) => candidate.id === creditId);
+  return credit && actionableCredit(credit) ? credit : null;
+}
+var CODEX_OVERVIEW_ROUTE_TIMEOUT_MS = 12e3;
+function createProviderCallLimiter(limit) {
+  if (!Number.isInteger(limit) || limit <= 0) {
+    throw new Error("Codex provider concurrency limit must be a positive integer");
+  }
+  let permits = limit;
+  const waiters = [];
+  const acquire = async () => {
+    if (permits > 0) {
+      permits -= 1;
+      return;
+    }
+    await new Promise((resolve) => waiters.push(resolve));
+  };
+  const release = () => {
+    const next = waiters.shift();
+    if (next) next();
+    else permits += 1;
+  };
+  return async (operation) => {
+    await acquire();
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  };
+}
+async function fetchCodexAccountOverview(deps, workspaceId, row, canRedeem, canResumeRedemption, redemptions = [], providerCall = async (operation) => await operation()) {
+  const fetchImpl = deps.codexFetch ?? fetch;
+  const [usageSettled, detailsSettled] = await Promise.allSettled([
+    providerCall(
+      async () => await fetchCodexUsageForAccount(deps.db, deps.settings, workspaceId, row.id, fetchImpl)
+    ),
+    providerCall(
+      async () => await fetchCodexRateLimitResetCreditsForAccount(
+        deps.db,
+        deps.settings,
+        workspaceId,
+        row.id,
+        fetchImpl
+      )
+    )
+  ]);
+  const liveUsage = usageSettled.status === "fulfilled" ? usageSettled.value : null;
+  const cached = cachedUsage(row);
+  const usageFromProvider = liveUsage != null && liveUsage.status !== "error";
+  const usageValue = usageFromProvider ? liveUsage : cached;
+  const usageSource = usageFromProvider ? "provider" : cached ? "cache" : "none";
+  const liveSummary = liveUsage?.rateLimitResetCredits ?? null;
+  const detailsResult = detailsSettled.status === "fulfilled" ? detailsSettled.value : null;
+  const details = detailsResult?.ok ? detailsResult.details : null;
+  const availableCount = details?.availableCount ?? liveSummary?.availableCount ?? row.resetCreditAvailableCount;
+  const availableDetailCount = details?.credits.filter((credit) => credit.status === "available").length ?? 0;
+  const availableDetailsComplete = !!details && details.availableCount === availableDetailCount;
+  const availableDetailsCapped = !!details && availableDetailCount < details.availableCount;
+  const availableDetailsImpossible = !!details && availableDetailCount > details.availableCount;
+  const summaryAgrees = !details || liveSummary == null || liveSummary.availableCount === details.availableCount;
+  const hasUnknown = details?.credits.some(
+    (credit) => credit.resetType === "unknown" || credit.status === "unknown"
+  ) ?? false;
+  const detailsComplete = availableDetailsComplete && summaryAgrees && !hasUnknown;
+  let detailState;
+  if (details) {
+    detailState = !summaryAgrees || hasUnknown || availableDetailsImpossible ? "unknown" : availableDetailsCapped ? "capped" : "detailed";
+  } else if (availableCount != null) {
+    detailState = "count_only";
+  } else if (detailsResult && !detailsResult.ok && detailsResult.reason === "invalid_response") {
+    detailState = "unknown";
+  } else if (detailsResult && !detailsResult.ok && detailsResult.reason === "http_error" && detailsResult.status === 404) {
+    detailState = "unsupported";
+  } else {
+    detailState = "error";
+  }
+  const resetSource = details || liveSummary ? "provider" : availableCount != null ? "cache" : "none";
+  const sorted = sortedCredits(details?.credits ?? []);
+  const actionAuthority = canRedeem && detailsComplete && detailState === "detailed";
+  return {
+    accountId: row.id,
+    usage: {
+      source: usageSource,
+      fetchedAt: usageValue?.fetchedAt ?? null,
+      stale: usageSource === "provider" ? false : staleAt(row.usageCheckedAt),
+      error: liveUsage?.status === "error" ? liveUsage.reason ?? "unavailable" : usageSettled.status === "rejected" ? "unavailable" : null,
+      value: usageValue
+    },
+    resetCredits: {
+      source: resetSource,
+      fetchedAt: resetSource === "provider" ? liveUsage?.fetchedAt ?? (/* @__PURE__ */ new Date()).toISOString() : row.resetCreditsCheckedAt?.toISOString() ?? null,
+      stale: resetSource === "provider" ? false : staleAt(row.resetCreditsCheckedAt),
+      error: detailsResult && !detailsResult.ok ? detailsResult.reason : detailsSettled.status === "rejected" ? "unavailable" : null,
+      detailState,
+      detailsComplete,
+      availableCount: availableCount ?? null,
+      credits: sorted.map((credit) => ({
+        ...credit,
+        actionable: actionAuthority && actionableCredit(credit)
+      }))
+    },
+    canRedeem,
+    canResumeRedemption,
+    redemptions: redemptions.map((redemption) => ({
+      attemptId: redemption.attemptId,
+      creditId: redemption.creditId,
+      status: redemption.status,
+      outcome: redemption.outcome,
+      providerStartedAt: redemption.providerStartedAt?.toISOString() ?? null,
+      completedAt: redemption.completedAt?.toISOString() ?? null,
+      createdAt: redemption.createdAt.toISOString(),
+      updatedAt: redemption.updatedAt.toISOString()
+    }))
+  };
+}
 async function signalCodexCapacityTargets(deps, targets) {
   await Promise.allSettled(
     targets.map(
@@ -4008,7 +4635,9 @@ function registerCodexRoutes(app, deps) {
     const { state } = await c.req.json();
     const payload = state ? readSignedState(state, githubStateSecret) : null;
     if (!payload || payload.workspaceId !== workspaceId || !payload.deviceAuthId || !payload.userCode) {
-      throw new HTTPException4(400, { message: "codex connect state is invalid or expired" });
+      throw new HTTPException4(400, {
+        message: "codex connect state is invalid or expired"
+      });
     }
     if (typeof payload.iat === "number" && Date.now() / 1e3 - payload.iat > CODEX_DEVICE_EXPIRY_SECONDS) {
       return c.json({ status: "expired" });
@@ -4042,6 +4671,7 @@ function registerCodexRoutes(app, deps) {
       });
     }
     const id = parseIdToken(tokens.idToken);
+    const connectingHuman = await managedCookieHuman(c, deps);
     const key = environmentsEncryptionKeyBytes2(settings);
     if (!key) {
       throw new HTTPException4(500, {
@@ -4072,12 +4702,18 @@ function registerCodexRoutes(app, deps) {
           expiresAt: accessTokenExpiry(tokens.accessToken),
           lastRefreshAt: /* @__PURE__ */ new Date(),
           accountEmail: id.email ?? null,
-          label: id.email ?? id.chatgptAccountId ?? null
+          label: id.email ?? id.chatgptAccountId ?? null,
+          connectedBySubjectId: connectingHuman?.subjectId === grant.subjectId ? connectingHuman.subjectId : null
         });
-        return { result: upserted2, changed: true };
+        return { result: upserted2, changed: upserted2.kind === "upserted" };
       }
     );
     const upserted = mutation.result;
+    if (upserted.kind === "unresolved_redemption") {
+      throw new HTTPException4(409, {
+        message: "this subscription has an unresolved reset redemption; recover it before changing ownership"
+      });
+    }
     const rotation = await getCodexRotationSettings(db, workspaceId);
     let isActive = rotation?.activeCredentialId === upserted.id;
     if (!isActive && rotation?.activeCredentialId == null) {
@@ -4200,7 +4836,9 @@ function registerCodexRoutes(app, deps) {
     );
     const updated = mutation.result;
     if (!updated) {
-      throw new HTTPException4(404, { message: "codex rotation settings not found" });
+      throw new HTTPException4(404, {
+        message: "codex rotation settings not found"
+      });
     }
     await signalCodexCapacityTargets(deps, mutation.wakeTargets);
     return c.json({
@@ -4227,6 +4865,39 @@ function registerCodexRoutes(app, deps) {
     }
     return c.json(codexAccountJson(row));
   });
+  app.patch("/v1/workspaces/:workspaceId/codex/accounts/:accountId/allocator", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+    const parsed = z.object({
+      enabled: z.boolean(),
+      expectedVersion: z.number().int().positive()
+    }).safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException4(400, {
+        message: "enabled and expectedVersion are required"
+      });
+    }
+    const mutation = await updateCodexAllocatorEligibility(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      credentialId: c.req.param("accountId"),
+      subjectId: grant.subjectId,
+      enabled: parsed.data.enabled,
+      expectedVersion: parsed.data.expectedVersion
+    });
+    const result = mutation.result;
+    if (result.kind === "not_found") {
+      throw new HTTPException4(404, { message: "codex account not found" });
+    }
+    const response = {
+      allocatorEnabled: result.allocatorEnabled,
+      allocatorVersion: result.allocatorVersion,
+      allocatorUpdatedAt: result.allocatorUpdatedAt,
+      changed: result.kind === "updated"
+    };
+    await signalCodexCapacityTargets(deps, mutation.wakeTargets);
+    return result.kind === "conflict" ? c.json(response, 409) : c.json(response);
+  });
   app.delete("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
@@ -4240,6 +4911,11 @@ function registerCodexRoutes(app, deps) {
       }
     );
     const result = mutation.result;
+    if (result.blockedByUnresolvedRedemption) {
+      throw new HTTPException4(409, {
+        message: "this subscription has an unresolved reset redemption; recover it before disconnecting"
+      });
+    }
     await signalCodexCapacityTargets(deps, mutation.wakeTargets);
     return c.json({ disconnected: result.removed, newActiveId: result.newActiveCredentialId });
   });
@@ -4250,20 +4926,27 @@ function registerCodexRoutes(app, deps) {
       db,
       { workspaceId, reason: "codex_credentials_disconnected" },
       async (tx) => {
-        const removed2 = await disconnectAllCodexAccounts(tx, workspaceId);
-        return { result: removed2, changed: removed2 > 0 };
+        const result2 = await disconnectAllCodexAccounts(tx, workspaceId);
+        return { result: result2, changed: result2.removed > 0 };
       }
     );
-    const removed = mutation.result;
+    const result = mutation.result;
+    if (result.blockedCredentialIds.length > 0) {
+      throw new HTTPException4(409, {
+        message: "one or more subscriptions have unresolved reset redemptions; recover them before disconnecting"
+      });
+    }
     await signalCodexCapacityTargets(deps, mutation.wakeTargets);
-    return c.json({ disconnected: removed > 0 });
+    return c.json({ disconnected: result.removed > 0 });
   });
   app.get("/v1/workspaces/:workspaceId/codex/usage", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
     const status = await getCodexCredentialStatus(db, workspaceId);
     if (!status?.credentialId) {
-      throw new HTTPException4(404, { message: "codex subscription is not connected" });
+      throw new HTTPException4(404, {
+        message: "codex subscription is not connected"
+      });
     }
     const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, status.credentialId);
     await signalPendingCodexCapacityTargets(deps, workspaceId);
@@ -4304,17 +4987,380 @@ function registerCodexRoutes(app, deps) {
             fiveHour: null,
             weekly: null,
             limitReached: false,
-            fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
+            fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            rateLimitResetCredits: null
           }
         };
       }
-    };
-    await Promise.all(
-      Array.from({ length: Math.min(CONCURRENCY, Math.max(1, accounts.length)) }, () => worker())
-    );
-    await signalPendingCodexCapacityTargets(deps, workspaceId);
-    return c.json({ usage });
-  });
+    };
+    await Promise.all(
+      Array.from({ length: Math.min(CONCURRENCY, Math.max(1, accounts.length)) }, () => worker())
+    );
+    await signalPendingCodexCapacityTargets(deps, workspaceId);
+    return c.json({ usage });
+  });
+  app.get("/v1/workspaces/:workspaceId/codex/overview", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
+    const human = await managedCookieHuman(c, deps);
+    const accounts = await listCodexAccountStatuses(db, workspaceId);
+    const ownerRecoveries = human && human.subjectId === grant.subjectId && hasPermission3(grant.permissions, "workspace:admin") ? await listCodexResetRedemptionRecoveries(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: human.subjectId
+    }) : [];
+    const overview = {};
+    const queue = [...accounts];
+    const providerCall = createProviderCallLimiter(4);
+    let routeTimedOut = false;
+    const worker = async () => {
+      for (; ; ) {
+        if (routeTimedOut) return;
+        const account = queue.shift();
+        if (!account) return;
+        const canResumeRedemption = Boolean(
+          human && human.subjectId === grant.subjectId && human.subjectId === account.connectedBySubjectId && hasPermission3(grant.permissions, "workspace:admin")
+        );
+        const canRedeem = canResumeRedemption && account.status === "active";
+        overview[account.id] = await fetchCodexAccountOverview(
+          deps,
+          workspaceId,
+          account,
+          canRedeem,
+          canResumeRedemption,
+          canResumeRedemption ? ownerRecoveries.filter((recovery) => recovery.credentialId === account.id) : [],
+          providerCall
+        );
+      }
+    };
+    const workers = Promise.all(
+      Array.from({ length: Math.min(4, Math.max(1, accounts.length)) }, () => worker())
+    );
+    let deadline;
+    await Promise.race([
+      workers,
+      new Promise((resolve) => {
+        deadline = setTimeout(() => {
+          routeTimedOut = true;
+          queue.length = 0;
+          resolve();
+        }, CODEX_OVERVIEW_ROUTE_TIMEOUT_MS);
+      })
+    ]);
+    if (deadline) clearTimeout(deadline);
+    if (routeTimedOut) {
+      const unavailableProviderCall = async () => {
+        throw new Error("Codex overview route deadline reached");
+      };
+      await Promise.all(
+        accounts.filter((account) => overview[account.id] == null).map(async (account) => {
+          const canResumeRedemption = Boolean(
+            human && human.subjectId === grant.subjectId && human.subjectId === account.connectedBySubjectId && hasPermission3(grant.permissions, "workspace:admin")
+          );
+          const fallback = await fetchCodexAccountOverview(
+            deps,
+            workspaceId,
+            account,
+            false,
+            canResumeRedemption,
+            canResumeRedemption ? ownerRecoveries.filter((recovery) => recovery.credentialId === account.id) : [],
+            unavailableProviderCall
+          );
+          overview[account.id] ??= fallback;
+        })
+      );
+      void workers.catch(() => void 0);
+    }
+    void signalPendingCodexCapacityTargets(deps, workspaceId).catch(() => void 0);
+    return c.json({ accounts: overview });
+  });
+  app.post(
+    "/v1/workspaces/:workspaceId/codex/accounts/:accountId/reset-credits/prepare",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const credentialId = c.req.param("accountId");
+      const { human, accountId } = await requireRedemptionHuman(c, deps, workspaceId);
+      c.header("cache-control", "no-store");
+      const parsed = redemptionPrepareBody.safeParse(await c.req.json().catch(() => null));
+      if (!parsed.success) {
+        throw new HTTPException4(400, {
+          message: "attemptId and creditId are required"
+        });
+      }
+      const accounts = await listCodexAccountStatuses(db, workspaceId);
+      const account = accounts.find((candidate) => candidate.id === credentialId);
+      if (!account) throw new HTTPException4(404, { message: "codex account not found" });
+      let existing = await getCodexResetRedemptionAttempt(db, workspaceId, parsed.data.attemptId);
+      if (account.connectedBySubjectId !== human.subjectId) {
+        throw new HTTPException4(403, {
+          message: "only the human who connected this subscription may redeem its reset credits"
+        });
+      }
+      if (existing && (existing.credentialId !== credentialId || existing.creditId !== parsed.data.creditId || existing.subjectId !== human.subjectId)) {
+        throw new HTTPException4(409, {
+          message: "logical redemption attempt identity mismatch"
+        });
+      }
+      if (existing) {
+        const adoption = await adoptCodexResetRedemptionAttempt(db, {
+          accountId,
+          workspaceId,
+          attemptId: existing.id,
+          credentialId,
+          creditId: existing.creditId,
+          subjectId: human.subjectId,
+          browserSessionHash: human.browserSessionHash
+        });
+        if (adoption.kind === "in_progress") {
+          throw new HTTPException4(409, {
+            message: "this redemption is still in progress in another browser request"
+          });
+        }
+        if (adoption.kind === "not_found") {
+          throw new HTTPException4(409, { message: "redemption recovery state changed" });
+        }
+        if (adoption.kind === "forbidden") {
+          throw new HTTPException4(403, { message: "redemption owner is unavailable" });
+        }
+        if (adoption.kind === "conflict") {
+          throw new HTTPException4(409, {
+            message: "logical redemption attempt identity mismatch"
+          });
+        }
+        existing = adoption.attempt;
+      }
+      if (account.status !== "active" && existing?.status !== "completed") {
+        throw new HTTPException4(403, { message: "redemption credential is unavailable" });
+      }
+      const secret = settings.betterAuthSecret;
+      if (!secret) {
+        throw new HTTPException4(503, {
+          message: "managed browser confirmation is unavailable"
+        });
+      }
+      const expiresAt = Math.floor(Date.now() / 1e3) + CODEX_REDEMPTION_CONFIRMATION_SECONDS;
+      const confirmationToken = await signCodexRedemptionConfirmation(secret, {
+        version: 1,
+        attemptId: parsed.data.attemptId,
+        workspaceId,
+        credentialId,
+        creditId: parsed.data.creditId,
+        subjectId: human.subjectId,
+        browserSessionHash: human.browserSessionHash,
+        expiresAt
+      });
+      return c.json({
+        attemptId: parsed.data.attemptId,
+        confirmationToken,
+        expiresAt: new Date(expiresAt * 1e3).toISOString(),
+        // A completed attempt may have lost its HTTP response after its outcome
+        // committed. Keep that exact logical id replayable without another
+        // provider consume call, just like an ambiguous provider_started attempt.
+        resumable: existing?.status === "provider_started" || existing?.status === "completed",
+        recoveryStatus: existing?.status === "provider_started" || existing?.status === "completed" ? existing.status : null
+      });
+    }
+  );
+  app.post(
+    "/v1/workspaces/:workspaceId/codex/accounts/:accountId/reset-credits/redeem",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const credentialId = c.req.param("accountId");
+      const { human, accountId } = await requireRedemptionHuman(c, deps, workspaceId);
+      c.header("cache-control", "no-store");
+      const parsed = redemptionBody.safeParse(await c.req.json().catch(() => null));
+      if (!parsed.success) {
+        throw new HTTPException4(400, {
+          message: "explicit redemption confirmation is required"
+        });
+      }
+      const secret = settings.betterAuthSecret;
+      if (!secret) {
+        throw new HTTPException4(503, {
+          message: "managed browser confirmation is unavailable"
+        });
+      }
+      const claims = await verifyCodexRedemptionConfirmation(secret, parsed.data.confirmationToken);
+      if (!claims || claims.attemptId !== parsed.data.attemptId || claims.workspaceId !== workspaceId || claims.credentialId !== credentialId || claims.creditId !== parsed.data.creditId || claims.subjectId !== human.subjectId || claims.browserSessionHash !== human.browserSessionHash) {
+        throw new HTTPException4(403, {
+          message: "redemption confirmation is invalid or expired"
+        });
+      }
+      const claimHolderId = crypto.randomUUID();
+      const claimed = await claimCodexResetRedemption(db, {
+        id: parsed.data.attemptId,
+        accountId,
+        workspaceId,
+        credentialId,
+        subjectId: human.subjectId,
+        browserSessionHash: human.browserSessionHash,
+        creditId: parsed.data.creditId,
+        confirmationExpiresAt: new Date(claims.expiresAt * 1e3),
+        claimHolderId
+      });
+      if (claimed.kind === "not_found") {
+        throw new HTTPException4(404, { message: "codex account not found" });
+      }
+      if (claimed.kind === "forbidden") {
+        throw new HTTPException4(403, {
+          message: "redemption owner or credential is unavailable"
+        });
+      }
+      if (claimed.kind === "conflict") {
+        throw new HTTPException4(409, {
+          message: "logical redemption attempt identity mismatch"
+        });
+      }
+      if (claimed.kind === "in_progress") {
+        return c.json({ status: "in_progress", attemptId: parsed.data.attemptId }, 409);
+      }
+      const finishResponse = (outcome) => c.json({
+        status: "completed",
+        attemptId: parsed.data.attemptId,
+        outcome,
+        // Durable provider truth must never wait for best-effort provider
+        // readback. The browser refreshes overview independently after this
+        // response; a hung account cannot suppress a completed outcome.
+        overview: null
+      });
+      if (claimed.kind === "completed") {
+        return finishResponse(claimed.attempt.outcome);
+      }
+      const attempt = claimed.attempt;
+      const fetchImpl = deps.codexFetch ?? fetch;
+      if (attempt.status === "processing") {
+        const details = await fetchCodexRateLimitResetCreditsForAccount(
+          db,
+          settings,
+          workspaceId,
+          credentialId,
+          fetchImpl
+        );
+        if (!details.ok) {
+          await abandonCodexResetRedemptionBeforeProvider(db, {
+            accountId,
+            workspaceId,
+            attemptId: attempt.id,
+            claimHolderId
+          });
+          return c.json(
+            {
+              status: "preflight_unavailable",
+              attemptId: attempt.id,
+              retryable: true
+            },
+            503
+          );
+        }
+        if (!freshActionableCredit(details.details, attempt.creditId)) {
+          await abandonCodexResetRedemptionBeforeProvider(db, {
+            accountId,
+            workspaceId,
+            attemptId: attempt.id,
+            claimHolderId
+          });
+          return c.json(
+            {
+              status: "not_actionable",
+              attemptId: attempt.id,
+              retryable: false
+            },
+            409
+          );
+        }
+      }
+      let token;
+      try {
+        token = await buildCodexTokenResolver(db, settings, workspaceId, credentialId).getToken();
+      } catch {
+        if (attempt.status === "processing") {
+          await abandonCodexResetRedemptionBeforeProvider(db, {
+            accountId,
+            workspaceId,
+            attemptId: attempt.id,
+            claimHolderId
+          });
+        } else {
+          await releaseCodexResetRedemptionClaim(db, {
+            accountId,
+            workspaceId,
+            attemptId: attempt.id,
+            claimHolderId,
+            failureKind: "provider_auth_unavailable"
+          });
+        }
+        return c.json(
+          {
+            status: "provider_unavailable",
+            attemptId: attempt.id,
+            retryable: true
+          },
+          503
+        );
+      }
+      const fenced = await fenceCodexResetRedemptionSend(db, {
+        accountId,
+        workspaceId,
+        attemptId: attempt.id,
+        claimHolderId,
+        credentialId,
+        subjectId: human.subjectId,
+        browserSessionHash: human.browserSessionHash
+      });
+      if (fenced.kind !== "ready") {
+        if (fenced.reason === "confirmation_expired") {
+          return c.json(
+            { status: "confirmation_expired", attemptId: attempt.id, retryable: true },
+            403
+          );
+        }
+        if (fenced.reason === "credential_unavailable") {
+          return c.json(
+            { status: "provider_unavailable", attemptId: attempt.id, retryable: true },
+            503
+          );
+        }
+        return c.json({ status: "in_progress", attemptId: attempt.id }, 409);
+      }
+      const sendAttempt = fenced.attempt;
+      const consumed = await consumeCodexRateLimitResetCredit(
+        {
+          accessToken: token.accessToken,
+          chatgptAccountId: token.chatgptAccountId,
+          isFedramp: token.isFedramp,
+          clientVersion: CODEX_CLIENT_VERSION
+        },
+        {
+          idempotencyKey: sendAttempt.upstreamIdempotencyKey,
+          creditId: sendAttempt.creditId
+        },
+        fetchImpl
+      );
+      if (!consumed.ok) {
+        await releaseCodexResetRedemptionClaim(db, {
+          accountId,
+          workspaceId,
+          attemptId: attempt.id,
+          claimHolderId,
+          failureKind: `provider_${consumed.reason}`
+        });
+        return c.json({ status: "ambiguous", attemptId: attempt.id, retryable: true }, 503);
+      }
+      const completion = await completeCodexResetRedemption(db, {
+        accountId,
+        workspaceId,
+        attemptId: attempt.id,
+        claimHolderId,
+        outcome: consumed.result.outcome
+      });
+      const completed = completion.result;
+      if (!completed) {
+        return c.json({ status: "in_progress", attemptId: attempt.id }, 409);
+      }
+      void signalCodexCapacityTargets(deps, completion.wakeTargets).catch(() => void 0);
+      return finishResponse(completed.outcome);
+    }
+  );
 }
 
 // src/routes/connections.ts
@@ -4350,7 +5396,6 @@ import {
   decryptEnvironmentValue,
   encryptEnvironmentValue as encryptEnvironmentValue2,
   getConnectionMetadata,
-  isPrivateAddress,
   listConnectionsMetadata,
   loadIntegrationOAuthClient,
   normalizeBearerScheme,
@@ -4358,10 +5403,16 @@ import {
   updateConnection
 } from "@opengeni/db";
 import { createSignedState as createSignedState2, readSignedState as readSignedState2 } from "@opengeni/github";
-import { Buffer as Buffer2 } from "buffer";
-import { createHash, randomBytes } from "crypto";
-import { lookup } from "dns/promises";
-import { isIP } from "net";
+import {
+  DestinationPolicyError,
+  OAUTH_MAX_RESPONSE_BYTES,
+  isLocalTestEnvironment,
+  pinnedFetch,
+  readResponseJsonBounded,
+  validateHttpUrl
+} from "@opengeni/network";
+import { Buffer as Buffer3 } from "buffer";
+import { createHash as createHash2, randomBytes } from "crypto";
 import { HTTPException as HTTPException6 } from "hono/http-exception";
 
 // src/integrations/provider-domain.ts
@@ -4375,6 +5426,7 @@ function canonicalProviderDomain(value) {
 }
 
 // src/integrations/oauth-client.ts
+import { OAUTH_MAX_RESPONSE_BYTES as OAUTH_MAX_RESPONSE_BYTES2 } from "@opengeni/network";
 var oauthStateTtlMs = 10 * 60 * 1e3;
 var OAuthCallbackStageError = class extends Error {
   constructor(stage, reason, cause) {
@@ -4444,6 +5496,7 @@ async function startMcpOAuth(deps, context) {
   });
   const authorizationUrl = buildAuthorizationUrl({
     endpoint: discovery.as.authorizationEndpoint,
+    settings,
     clientId: client.clientId,
     redirectUri,
     state,
@@ -4614,10 +5667,14 @@ async function probeMcpChallenge(resource, settings) {
     method: "GET",
     headers: { accept: "application/json" }
   });
-  if (response.status !== 401) {
-    return {};
+  try {
+    if (response.status !== 401) {
+      return {};
+    }
+    return parseWwwAuthenticate(response.headers.get("www-authenticate"));
+  } finally {
+    await cancelResponseBody(response);
   }
-  return parseWwwAuthenticate(response.headers.get("www-authenticate"));
 }
 async function discoverProtectedResourceMetadata(resource, settings, advertisedUrl) {
   const candidates = uniqueStrings([
@@ -4648,10 +5705,15 @@ async function discoverProtectedResourceMetadata(resource, settings, advertisedU
   throw new HTTPException6(422, { message: "could not discover MCP protected resource metadata" });
 }
 async function discoverAuthorizationServerMetadata(authorizationServer, settings) {
-  const candidates = uniqueStrings([
+  const safeAuthorizationServer = oauthEndpointUrl(
     authorizationServer,
-    ...wellKnownCandidates(authorizationServer, "oauth-authorization-server"),
-    ...wellKnownCandidates(authorizationServer, "openid-configuration")
+    settings,
+    "OAuth authorization server"
+  ).replace(/\/+$/, "");
+  const candidates = uniqueStrings([
+    safeAuthorizationServer,
+    ...wellKnownCandidates(safeAuthorizationServer, "oauth-authorization-server"),
+    ...wellKnownCandidates(safeAuthorizationServer, "openid-configuration")
   ]);
   for (const candidate of candidates) {
     const payload = await fetchJsonObject(candidate, settings).catch((error) => {
@@ -4668,16 +5730,29 @@ async function discoverAuthorizationServerMetadata(authorizationServer, settings
     if (!authorizationEndpoint || !tokenEndpoint) {
       continue;
     }
-    return {
-      issuer: stringValue(payload.issuer) ?? authorizationServer.replace(/\/+$/, ""),
-      authorizationServer: authorizationServer.replace(/\/+$/, ""),
+    const safeAuthorizationEndpoint = oauthEndpointUrl(
       authorizationEndpoint,
-      tokenEndpoint,
+      settings,
+      "OAuth authorization endpoint"
+    );
+    const safeTokenEndpoint = oauthEndpointUrl(tokenEndpoint, settings, "OAuth token endpoint");
+    const registrationEndpoint = stringValue(payload.registration_endpoint);
+    const issuer = oauthEndpointUrl(
+      stringValue(payload.issuer) ?? safeAuthorizationServer,
+      settings,
+      "OAuth issuer"
+    );
+    const safeRegistrationEndpoint = registrationEndpoint ? oauthEndpointUrl(registrationEndpoint, settings, "OAuth registration endpoint") : void 0;
+    return {
+      issuer,
+      authorizationServer: safeAuthorizationServer,
+      authorizationEndpoint: safeAuthorizationEndpoint,
+      tokenEndpoint: safeTokenEndpoint,
       clientIdMetadataDocumentSupported: payload.client_id_metadata_document_supported === true,
       tokenEndpointAuthMethodsSupported: stringArray(payload.token_endpoint_auth_methods_supported),
       codeChallengeMethodsSupported: stringArray(payload.code_challenge_methods_supported),
       raw: payload,
-      ...stringValue(payload.registration_endpoint) ? { registrationEndpoint: stringValue(payload.registration_endpoint) } : {}
+      ...safeRegistrationEndpoint ? { registrationEndpoint: safeRegistrationEndpoint } : {}
     };
   }
   throw new HTTPException6(422, {
@@ -4829,7 +5904,6 @@ async function dynamicClientRegistration(settings, as, redirectUri, scopes) {
       message: "authorization server does not support dynamic client registration"
     });
   }
-  await assertOAuthFetchAllowed(as.registrationEndpoint, settings);
   const response = await fetchOAuth(as.registrationEndpoint, settings, {
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
@@ -4843,11 +5917,16 @@ async function dynamicClientRegistration(settings, as, redirectUri, scopes) {
     })
   });
   if (!response.ok) {
+    await cancelResponseBody(response);
     throw new HTTPException6(422, {
       message: `dynamic client registration failed with HTTP ${response.status}`
     });
   }
-  const payload = await response.json();
+  const payload = await readResponseJsonBounded(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth dynamic registration response"
+  );
   const clientId = stringValue(payload.client_id);
   if (!clientId) {
     throw new HTTPException6(422, {
@@ -4877,7 +5956,8 @@ async function existingOAuthConnectionForStart(db, input) {
   ) ?? null;
 }
 function buildAuthorizationUrl(input) {
-  const url = new URL(input.endpoint);
+  const endpoint = oauthEndpointUrl(input.endpoint, input.settings, "OAuth authorization endpoint");
+  const url = new URL(endpoint);
   url.searchParams.set("response_type", "code");
   url.searchParams.set("client_id", input.clientId);
   url.searchParams.set("redirect_uri", input.redirectUri);
@@ -4915,9 +5995,21 @@ function readOAuthState(state, settings) {
       "state.encryptedPkceVerifier"
     ),
     clientId: requiredString(payload.clientId, "state.clientId"),
-    tokenEndpoint: requiredString(payload.tokenEndpoint, "state.tokenEndpoint"),
-    authorizationServer: requiredString(payload.authorizationServer, "state.authorizationServer"),
-    issuer: requiredString(payload.issuer, "state.issuer"),
+    tokenEndpoint: oauthEndpointUrl(
+      requiredString(payload.tokenEndpoint, "state.tokenEndpoint"),
+      settings,
+      "OAuth token endpoint"
+    ),
+    authorizationServer: oauthEndpointUrl(
+      requiredString(payload.authorizationServer, "state.authorizationServer"),
+      settings,
+      "OAuth authorization server"
+    ).replace(/\/+$/, ""),
+    issuer: oauthEndpointUrl(
+      requiredString(payload.issuer, "state.issuer"),
+      settings,
+      "OAuth issuer"
+    ),
     clientRegistrationMethod: registrationMethod(payload.clientRegistrationMethod),
     tokenEndpointAuthMethod: tokenAuthMethod(stringValue(payload.tokenEndpointAuthMethod), false),
     ...stringValue(payload.encryptedClientSecret) ? { encryptedClientSecret: stringValue(payload.encryptedClientSecret) } : {},
@@ -4956,7 +6048,7 @@ async function clientForState(db, settings, state) {
   }
   if (state.clientRegistrationMethod === "dcr") {
     const stored = await loadIntegrationOAuthClient(db, settings, state.issuer);
-    if (!stored || stored.clientId !== state.clientId) {
+    if (!stored || stored.clientId !== state.clientId || stored.issuer !== state.issuer || stored.authorizationServer !== state.authorizationServer) {
       throw new HTTPException6(400, { message: "OAuth client registration is no longer available" });
     }
     return {
@@ -4990,7 +6082,6 @@ async function clientForState(db, settings, state) {
   };
 }
 async function exchangeAuthorizationCode(settings, input) {
-  await assertOAuthFetchAllowed(input.tokenEndpoint, settings);
   const body = new URLSearchParams();
   body.set("grant_type", "authorization_code");
   body.set("code", input.code);
@@ -5005,7 +6096,7 @@ async function exchangeAuthorizationCode(settings, input) {
     body.set("client_id", input.client.clientId);
     body.set("client_secret", input.client.clientSecret);
   } else if (input.client.clientSecret && input.client.tokenEndpointAuthMethod === "client_secret_basic") {
-    headers.authorization = `Basic ${Buffer2.from(`${input.client.clientId}:${input.client.clientSecret}`).toString("base64")}`;
+    headers.authorization = `Basic ${Buffer3.from(`${input.client.clientId}:${input.client.clientSecret}`).toString("base64")}`;
   } else {
     body.set("client_id", input.client.clientId);
   }
@@ -5022,7 +6113,11 @@ async function exchangeAuthorizationCode(settings, input) {
       new Error(`OAuth token endpoint returned HTTP ${response.status}`)
     );
   }
-  const payload = await response.json();
+  const payload = await readResponseJsonBounded(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth token response"
+  );
   const accessToken = stringValue(payload.access_token);
   if (!accessToken) {
     throw new Error("OAuth token response did not include access_token");
@@ -5093,9 +6188,14 @@ function safeHost(rawUrl) {
 async function oauthErrorFromResponse(response) {
   const contentType = response.headers.get("content-type") ?? "";
   if (!contentType.toLowerCase().includes("application/json")) {
+    await cancelResponseBody(response);
     return null;
   }
-  const payload = await response.clone().json().catch(() => null);
+  const payload = await readResponseJsonBounded(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth token error response"
+  ).catch(() => null);
   const error = stringValue(payload?.error);
   if (!error || !/^[a-zA-Z0-9_.-]{1,80}$/.test(error)) {
     return null;
@@ -5103,7 +6203,6 @@ async function oauthErrorFromResponse(response) {
   return error;
 }
 async function verifyMcpToolsList(settings, resource, token) {
-  await assertOAuthFetchAllowed(resource, settings);
   const client = new Client2(
     { name: "opengeni-integration-verify", version: "0.1.0" },
     { capabilities: {} }
@@ -5215,6 +6314,19 @@ function canonicalOAuthResource(value) {
     });
   }
 }
+function oauthEndpointUrl(rawUrl, settings, label) {
+  try {
+    return validateHttpUrl(rawUrl, {
+      label,
+      allowLoopbackHttp: isLocalTestEnvironment(settings.environment)
+    });
+  } catch (error) {
+    if (error instanceof DestinationPolicyError) {
+      throw new HTTPException6(422, { message: error.message });
+    }
+    throw error;
+  }
+}
 function safeReturnPath(value) {
   if (!value.startsWith("/") || value.startsWith("//")) {
     throw new HTTPException6(400, { message: "OAuth returnPath must be a relative path" });
@@ -5228,59 +6340,71 @@ function safeReturnPath(value) {
 async function fetchJsonObject(url, settings) {
   const response = await fetchOAuth(url, settings, { headers: { accept: "application/json" } });
   if (!response.ok) {
+    await cancelResponseBody(response);
     throw new Error(`HTTP ${response.status}`);
   }
-  const payload = await response.json();
+  const payload = await readResponseJsonBounded(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth metadata response"
+  );
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
     throw new Error("metadata response was not a JSON object");
   }
   return payload;
 }
 async function fetchOAuth(rawUrl, settings, init = {}, hop = 0) {
-  await assertOAuthFetchAllowed(rawUrl, settings);
-  const response = await fetch(rawUrl, { ...init, redirect: "manual" });
+  let response;
+  try {
+    const endpoint = oauthEndpointUrl(rawUrl, settings, "OAuth endpoint");
+    response = await pinnedFetch(endpoint, init, settings, {
+      label: "OAuth discovery",
+      requireHttpsOutsideLocalTest: true
+    });
+  } catch (error) {
+    if (error instanceof DestinationPolicyError) {
+      throw new HTTPException6(422, { message: error.message });
+    }
+    throw error;
+  }
   if (response.status < 300 || response.status >= 400) {
     return response;
   }
+  if (!oauthRequestMayFollowRedirect(init)) {
+    await cancelResponseBody(response);
+    throw new HTTPException6(422, {
+      message: "OAuth credential-bearing requests may not follow redirects"
+    });
+  }
   if (hop >= 3) {
+    await cancelResponseBody(response);
     throw new HTTPException6(422, { message: "OAuth fetch exceeded maximum redirect hops" });
   }
   const location = response.headers.get("location");
   if (!location) {
+    await cancelResponseBody(response);
     throw new HTTPException6(422, { message: "OAuth fetch redirect was missing Location" });
   }
   let nextUrl;
   try {
     nextUrl = new URL(location, rawUrl).toString();
   } catch {
+    await cancelResponseBody(response);
     throw new HTTPException6(422, { message: "OAuth fetch redirect Location was invalid" });
   }
+  await cancelResponseBody(response);
   return await fetchOAuth(nextUrl, settings, init, hop + 1);
 }
-async function assertOAuthFetchAllowed(rawUrl, settings) {
-  const url = new URL(rawUrl);
-  if (!["https:", "http:"].includes(url.protocol)) {
-    throw new HTTPException6(422, { message: "OAuth discovery only supports http and https URLs" });
-  }
-  if (settings.integrationsAllowPrivateNetworkTargets || ["local", "test"].includes(settings.environment)) {
-    return;
-  }
-  if (url.protocol !== "https:") {
-    throw new HTTPException6(422, {
-      message: "OAuth discovery targets must use https outside local/test"
-    });
-  }
-  const hostname = url.hostname.toLowerCase();
-  if (hostname === "localhost" || hostname.endsWith(".localhost")) {
-    throw new HTTPException6(422, { message: "OAuth discovery may not target localhost" });
-  }
-  const literal2 = isIP(hostname);
-  const addresses = literal2 ? [hostname] : (await lookup(hostname, { all: true })).map((entry) => entry.address);
-  if (addresses.some(isPrivateAddress)) {
-    throw new HTTPException6(422, {
-      message: "OAuth discovery may not target private network addresses"
-    });
+function oauthRequestMayFollowRedirect(init) {
+  const method = (init.method ?? "GET").toUpperCase();
+  if (method !== "GET" && method !== "HEAD" || init.body != null) {
+    return false;
   }
+  const headers = new Headers(init.headers);
+  return [...headers.keys()].every((name) => name === "accept");
+}
+async function cancelResponseBody(response) {
+  await response.body?.cancel().catch(() => void 0);
 }
 function parseWwwAuthenticate(header) {
   if (!header) {
@@ -5353,7 +6477,7 @@ function expiresAtFromTokenResponse(payload) {
   return null;
 }
 function pkceChallenge(verifier) {
-  return createHash("sha256").update(verifier).digest("base64url");
+  return createHash2("sha256").update(verifier).digest("base64url");
 }
 function randomPkceVerifier() {
   return randomBytes(32).toString("base64url");
@@ -5589,14 +6713,14 @@ import {
 } from "@opengeni/documents";
 import { createKnowledgeMemory, listKnowledgeMemories } from "@opengeni/db";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
-import * as z from "zod/v4";
+import * as z2 from "zod/v4";
 var SearchInputSchema = {
-  query: z.string().min(1),
-  baseIds: z.array(z.string().uuid()).optional(),
-  limit: z.number().int().positive().max(50).optional(),
-  mode: z.enum(["hybrid", "vector", "keyword"]).optional(),
-  sourceKinds: z.array(
-    z.enum([
+  query: z2.string().min(1),
+  baseIds: z2.array(z2.string().uuid()).optional(),
+  limit: z2.number().int().positive().max(50).optional(),
+  mode: z2.enum(["hybrid", "vector", "keyword"]).optional(),
+  sourceKinds: z2.array(
+    z2.enum([
       "manual_upload",
       "meeting_transcript",
       "repository",
@@ -5607,15 +6731,15 @@ var SearchInputSchema = {
       "other"
     ])
   ).optional(),
-  aclTags: z.array(z.string().min(1)).optional()
+  aclTags: z2.array(z2.string().min(1)).optional()
 };
-var MemoryKindSchema2 = z.enum(["semantic", "episodic", "procedural", "decision", "preference"]);
-var SourceRefSchema = z.object({
-  kind: z.enum(["document_chunk", "document", "session_event", "memory", "external"]),
-  id: z.string().min(1),
-  uri: z.string().min(1).optional(),
-  title: z.string().min(1).optional(),
-  metadata: z.record(z.string(), z.unknown()).optional()
+var MemoryKindSchema2 = z2.enum(["semantic", "episodic", "procedural", "decision", "preference"]);
+var SourceRefSchema = z2.object({
+  kind: z2.enum(["document_chunk", "document", "session_event", "memory", "external"]),
+  id: z2.string().min(1),
+  uri: z2.string().min(1).optional(),
+  title: z2.string().min(1).optional(),
+  metadata: z2.record(z2.string(), z2.unknown()).optional()
 });
 function buildDocumentsMcpServer(db, accountId, workspaceId, documentServices, options = {}) {
   const server = new McpServer2({
@@ -5653,7 +6777,7 @@ function buildDocumentsMcpServer(db, accountId, workspaceId, documentServices, o
     {
       description: "Fetch one indexed document chunk by id.",
       inputSchema: {
-        chunkId: z.string().uuid()
+        chunkId: z2.string().uuid()
       }
     },
     async ({ chunkId }) => {
@@ -5671,7 +6795,7 @@ function buildDocumentsMcpServer(db, accountId, workspaceId, documentServices, o
     {
       description: "Fetch one knowledge source chunk by id.",
       inputSchema: {
-        chunkId: z.string().uuid()
+        chunkId: z2.string().uuid()
       }
     },
     async ({ chunkId }) => {
@@ -5689,10 +6813,10 @@ function buildDocumentsMcpServer(db, accountId, workspaceId, documentServices, o
     {
       description: "Search approved company memory records.",
       inputSchema: {
-        query: z.string().min(1).optional(),
+        query: z2.string().min(1).optional(),
         kind: MemoryKindSchema2.optional(),
-        scope: z.string().min(1).optional(),
-        limit: z.number().int().positive().max(100).optional()
+        scope: z2.string().min(1).optional(),
+        limit: z2.number().int().positive().max(100).optional()
       }
     },
     async ({ query, kind, scope, limit }) => ({
@@ -5717,12 +6841,12 @@ function buildDocumentsMcpServer(db, accountId, workspaceId, documentServices, o
     {
       description: "Propose a company memory record for human review.",
       inputSchema: {
-        text: z.string().min(1),
+        text: z2.string().min(1),
         kind: MemoryKindSchema2.optional(),
-        scope: z.string().min(1).optional(),
-        sourceRefs: z.array(SourceRefSchema).optional(),
-        confidence: z.number().min(0).max(1).optional(),
-        metadata: z.record(z.string(), z.unknown()).optional()
+        scope: z2.string().min(1).optional(),
+        sourceRefs: z2.array(SourceRefSchema).optional(),
+        confidence: z2.number().min(0).max(1).optional(),
+        metadata: z2.record(z2.string(), z2.unknown()).optional()
       }
     },
     async ({ text, kind, scope, sourceRefs, confidence, metadata }) => ({
@@ -7158,7 +8282,12 @@ import {
   CreateFileUploadRequest,
   CreateFileUploadResponse,
   FileAsset,
-  FileDownloadUrlResponse
+  FileDownloadUrlResponse,
+  RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,
+  RETAINED_OUTPUT_MAX_PAGE_BYTES,
+  RetainedArtifactMetadataSchema,
+  retainedArtifactReferenceFromFile,
+  resolveRetainedOutputRange
 } from "@opengeni/contracts";
 import {
   claimFileUploadCleanup,
@@ -7166,6 +8295,7 @@ import {
   completeFileUpload,
   createFileUpload,
   getFileUpload,
+  getRetainedFileArtifact,
   requireFile as requireFile2
 } from "@opengeni/db";
 import { HTTPException as HTTPException12 } from "hono/http-exception";
@@ -7361,6 +8491,84 @@ function registerFileRoutes(app, deps) {
     }
     return c.json(FileAsset.parse(file));
   });
+  app.get("/v1/workspaces/:workspaceId/artifacts/:artifactId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant8(c, deps, workspaceId, "files:read");
+    const artifactId = retainedArtifactId(c.req.param("artifactId"));
+    const artifact = await getRetainedFileArtifact(db, workspaceId, artifactId);
+    if (!artifact) {
+      return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
+    }
+    return c.json(retainedArtifactMetadata(artifact));
+  });
+  app.get("/v1/workspaces/:workspaceId/artifacts/:artifactId/content", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant8(c, deps, workspaceId, "files:read");
+    const artifactId = retainedArtifactId(c.req.param("artifactId"));
+    const artifact = await getRetainedFileArtifact(db, workspaceId, artifactId);
+    if (!artifact) {
+      return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
+    }
+    const metadata = retainedArtifactMetadata(artifact);
+    if (!metadata.available) {
+      return c.json(metadata, retainedArtifactUnavailableStatus(metadata.reason));
+    }
+    if (!objectStorage) {
+      return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 503);
+    }
+    const rangeHeader = c.req.header("range");
+    const range = resolveRetainedOutputRange(
+      rangeHeader,
+      metadata.originalBytes,
+      rangeHeader ? RETAINED_OUTPUT_MAX_PAGE_BYTES : RETAINED_OUTPUT_DEFAULT_PAGE_BYTES
+    );
+    if (range.kind === "invalid") {
+      return c.json(
+        {
+          message: "invalid retained artifact byte range",
+          reason: range.reason,
+          maxRangeBytes: RETAINED_OUTPUT_MAX_PAGE_BYTES
+        },
+        400
+      );
+    }
+    if (range.kind === "unsatisfiable") {
+      return c.json(
+        { message: "retained artifact byte range is not satisfiable", reason: range.reason },
+        416,
+        {
+          "Accept-Ranges": "bytes",
+          "Content-Range": range.contentRange,
+          "Cache-Control": "private, no-store"
+        }
+      );
+    }
+    const headers = {
+      "Accept-Ranges": range.acceptRanges,
+      "Cache-Control": "private, no-store",
+      "Content-Length": String(range.length),
+      "Content-Type": metadata.contentType,
+      "X-Content-Type-Options": "nosniff",
+      ...range.contentRange ? { "Content-Range": range.contentRange } : {}
+    };
+    if (range.kind === "empty") {
+      if (!await objectStorage.fileExists(artifact.file)) {
+        return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
+      }
+      return c.body(null, 200, headers);
+    }
+    const bytes = await objectStorage.getFileRange(artifact.file, {
+      start: range.start,
+      end: range.end
+    });
+    if (!bytes) {
+      return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
+    }
+    if (bytes.byteLength !== range.length) {
+      throw new HTTPException12(502, { message: "object storage returned an invalid byte range" });
+    }
+    return c.body(new Uint8Array(bytes), range.status, headers);
+  });
   app.post("/v1/workspaces/:workspaceId/files/:fileId/download-url", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant8(c, deps, workspaceId, "files:read");
@@ -7391,6 +8599,50 @@ function sanitizeFilename(filename) {
 function publicFileUploadStatus(status) {
   return status === "cleanup_pending" ? "failed" : status;
 }
+function retainedArtifactId(value) {
+  const parsed = FileAsset.shape.id.safeParse(value);
+  if (!parsed.success) {
+    throw new HTTPException12(404, { message: "artifact not found" });
+  }
+  return parsed.data;
+}
+function retainedArtifactUnavailable(artifactId, reason) {
+  return RetainedArtifactMetadataSchema.parse({ available: false, artifactId, reason });
+}
+function retainedArtifactMetadata(artifact) {
+  const reference = retainedArtifactReferenceFromFile(artifact.file);
+  if (reference) return reference;
+  const { file, uploadStatus, uploadExpiresAt } = artifact;
+  if (file.status === "deleted") {
+    return retainedArtifactUnavailable(file.id, "deleted");
+  }
+  if (file.status === "expired" || uploadStatus === "expired" || uploadStatus === "pending" && uploadExpiresAt !== null && uploadExpiresAt.getTime() < Date.now()) {
+    return retainedArtifactUnavailable(file.id, "expired");
+  }
+  if (file.status === "failed" || uploadStatus === "failed" || uploadStatus === "cleanup_pending") {
+    return retainedArtifactUnavailable(file.id, "failed");
+  }
+  if (file.status === "pending_upload" || uploadStatus === "pending") {
+    return retainedArtifactUnavailable(file.id, "pending");
+  }
+  return retainedArtifactUnavailable(file.id, "unsupported");
+}
+function retainedArtifactUnavailableStatus(reason) {
+  switch (reason) {
+    case "deleted":
+      return 404;
+    case "expired":
+    case "missing_storage":
+      return 410;
+    case "unsupported":
+    case "not_retained":
+    case "storage_write_failed":
+      return 422;
+    case "pending":
+    case "failed":
+      return 409;
+  }
+}
 
 // src/routes/api-keys.ts
 import { CreateApiKeyRequest, CreateApiKeyResponse } from "@opengeni/contracts";
@@ -8783,14 +10035,20 @@ import {
   SessionEventPayloadMode as SessionEventPayloadMode2,
   SessionEventReadDirection as SessionEventReadDirection2,
   SessionEventReadMode as SessionEventReadMode2,
+  SessionEventLatestClass as SessionEventLatestClass2,
+  SessionEventResultMode as SessionEventResultMode2,
   SessionEventSemanticClass as SessionEventSemanticClass2,
   SessionEventType as SessionEventType2,
+  SessionMcpServerId,
+  compactSessionEventResult as compactSessionEventResult2,
+  sessionEventLatestClassToSemanticClass as sessionEventLatestClassToSemanticClass2,
   SaveComposerDraftRequest,
   SteerSessionQueueItemRequest,
   SteerSessionMessageRequest,
   TerminalExecRequest,
   UpdateSessionPinRequest,
   UpdateSessionGoalRequest,
+  UpdateSessionMcpApprovalPolicyRequest,
   UpdateSessionRequest,
   ViewerHeartbeatRequest,
   WORKSPACE_CONTROL_ACTOR_MAX_BYTES,
@@ -8846,7 +10104,7 @@ import {
   coalesceSessionEventDeltas,
   publishDurableSessionEvents
 } from "@opengeni/events";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/sandbox/channel-a.ts
 import {
@@ -9081,7 +10339,7 @@ import {
 } from "@opengeni/core";
 
 // src/sandbox/viewer.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import {
   applyGitAuthPointerEnvironment as applyGitAuthPointerEnvironment2,
   hasGitCredentialRepositorySelection as hasGitCredentialRepositorySelection2,
@@ -9376,7 +10634,13 @@ async function mintDesktopStream(services, input) {
       return null;
     }
     try {
-      await ensureDisplayStack(established.session);
+      await ensureDisplayStack(established.session, {
+        telemetryContext: {
+          callerKind: "viewer",
+          ...lease.instanceId ? { sandboxId: lease.instanceId } : {},
+          leaseEpoch: lease.leaseEpoch
+        }
+      });
     } catch (error) {
       if (error instanceof DisplayStackUnsupportedError) {
         return null;
@@ -9634,7 +10898,7 @@ function viewerIdAsUuid(rawViewerId) {
   if (UUID_RE.test(rawViewerId)) {
     return rawViewerId;
   }
-  const hex = createHash2("sha256").update(`opengeni:stream-viewer:${rawViewerId}`).digest("hex");
+  const hex = createHash3("sha256").update(`opengeni:stream-viewer:${rawViewerId}`).digest("hex");
   const b = hex.slice(0, 32).split("");
   b[12] = "5";
   const variantNibble = parseInt(b[16], 16) & 3 | 8;
@@ -9655,8 +10919,12 @@ import {
   readSessionLineage,
   saveHumanComposerDraft,
   steerHumanQueuePrompt,
+  updateSessionMcpApprovalPolicy,
   updateSessionTitle as updateSessionTitle2,
-  workflowIdForSession
+  workflowIdForSession,
+  sessionWithEffectiveToolPolicy as sessionWithEffectiveToolPolicy2,
+  workspaceSessionToolPolicyDefaultServerIds as workspaceSessionToolPolicyDefaultServerIds2,
+  workspaceSessionToolPolicyServerIds as workspaceSessionToolPolicyServerIds2
 } from "@opengeni/core";
 
 // src/http/sse.ts
@@ -9679,7 +10947,7 @@ function createByteBoundedSseStream(options = {}) {
   if (!Number.isSafeInteger(stallTimeoutMs) || stallTimeoutMs <= 0) {
     throw new RangeError("SSE write stall timeout must be a positive safe integer");
   }
-  const encoder = new TextEncoder();
+  const encoder2 = new TextEncoder();
   let controller;
   let stopped = false;
   let capacityWake = null;
@@ -9725,7 +10993,7 @@ function createByteBoundedSseStream(options = {}) {
   return {
     stream,
     write: async (frame) => {
-      const chunk = encoder.encode(frame);
+      const chunk = encoder2.encode(frame);
       if (chunk.byteLength > maxQueuedBytes) {
         const error = new RangeError(
           `SSE frame cannot fit in the configured queue (${chunk.byteLength} > ${maxQueuedBytes} bytes)`
@@ -10335,7 +11603,7 @@ function registerSessionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:create");
     const session = await createSessionForRequest2(deps, grant, workspaceId, await c.req.json());
-    return c.json(session, 202);
+    return c.json(await withEffectivePolicy(deps, workspaceId, session), 202);
   });
   app.get("/v1/workspaces/:workspaceId/sessions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -10368,16 +11636,26 @@ function registerSessionRoutes(app, deps) {
       throw error;
     }
     c.header("x-opengeni-pinned-truncated", page.pinnedTruncated === true ? "true" : "false");
+    const policy = await loadEffectivePolicyContext(deps, workspaceId);
+    const decorate = (session) => sessionWithEffectiveToolPolicy2(
+      session,
+      policy.workspaceServerIds,
+      policy.workspaceDefaultServerIds
+    );
     if (pageView) {
-      return c.json(page);
+      return c.json({
+        ...page,
+        pinned: page.pinned.map(decorate),
+        sessions: page.sessions.map(decorate)
+      });
     }
-    return c.json([...page.pinned, ...page.sessions]);
+    return c.json([...page.pinned, ...page.sessions].map(decorate));
   });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
-    if (!z2.string().uuid().safeParse(sessionId).success) {
+    if (!z3.string().uuid().safeParse(sessionId).success) {
       throw new HTTPException21(404, { message: "session not found" });
     }
     const session = await getSessionForSubject(
@@ -10390,13 +11668,13 @@ function registerSessionRoutes(app, deps) {
     if (!session) {
       throw new HTTPException21(404, { message: "session not found" });
     }
-    return c.json(session);
+    return c.json(await withEffectivePolicy(deps, workspaceId, session));
   });
   app.put("/v1/workspaces/:workspaceId/sessions/:sessionId/pin", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
-    if (!z2.string().uuid().safeParse(sessionId).success) {
+    if (!z3.string().uuid().safeParse(sessionId).success) {
       throw new HTTPException21(404, { message: "session not found" });
     }
     const parsed = UpdateSessionPinRequest.safeParse(await c.req.json().catch(() => null));
@@ -10413,7 +11691,13 @@ function registerSessionRoutes(app, deps) {
       if (!session) {
         throw new HTTPException21(404, { message: "session not found" });
       }
-      return c.json(projectSessionForRelatedAccess2(session, relatedSessionAccessFor(c)));
+      return c.json(
+        await withEffectivePolicy(
+          deps,
+          workspaceId,
+          projectSessionForRelatedAccess2(session, relatedSessionAccessFor(c))
+        )
+      );
     } catch (error) {
       if (error instanceof SessionPinAccessError) {
         throw new HTTPException21(403, { message: error.message });
@@ -10433,7 +11717,19 @@ function registerSessionRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/lineage", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
-    return c.json(await readSessionLineage(deps, grant, c.req.param("sessionId")));
+    const lineage = await readSessionLineage(deps, grant, c.req.param("sessionId"));
+    const policy = await loadEffectivePolicyContext(deps, workspaceId);
+    return c.json({
+      ...lineage,
+      ancestors: lineage.ancestors.map(
+        (session) => sessionWithEffectiveToolPolicy2(
+          session,
+          policy.workspaceServerIds,
+          policy.workspaceDefaultServerIds
+        )
+      ),
+      children: mapLineageNodes(lineage.children, policy)
+    });
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/codex-account", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -10498,8 +11794,33 @@ function registerSessionRoutes(app, deps) {
     if (!session) {
       throw new HTTPException21(404, { message: "session not found" });
     }
-    return c.json(session);
+    return c.json(await withEffectivePolicy(deps, workspaceId, session));
   });
+  app.patch(
+    "/v1/workspaces/:workspaceId/sessions/:sessionId/mcp-servers/:serverId/approval-policy",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
+      const sessionId = c.req.param("sessionId");
+      const parsedServerId = SessionMcpServerId.safeParse(c.req.param("serverId"));
+      const payload = UpdateSessionMcpApprovalPolicyRequest.safeParse(
+        await c.req.json().catch(() => null)
+      );
+      if (!parsedServerId.success || !payload.success) {
+        throw new HTTPException21(400, { message: "invalid MCP approval-policy request" });
+      }
+      await assertSessionExists(db, workspaceId, sessionId);
+      return c.json(
+        await updateSessionMcpApprovalPolicy(
+          deps,
+          grant,
+          sessionId,
+          parsedServerId.data,
+          payload.data.requireApproval
+        )
+      );
+    }
+  );
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/goal", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
@@ -10674,12 +11995,24 @@ function registerSessionRoutes(app, deps) {
       "mode",
       explicitReplay ? "forensic" : "monitoring"
     );
-    const latestClass = eventEnumValue(
+    const latestRequested = eventEnumValue(
       c.req.query("latest"),
-      SessionEventSemanticClass2,
+      SessionEventLatestClass2,
       "latest",
       void 0
     );
+    const latestClass = latestRequested === void 0 ? void 0 : sessionEventLatestClassToSemanticClass2(latestRequested);
+    const resultMode = eventEnumValue(
+      c.req.query("resultMode") ?? c.req.query("result"),
+      SessionEventResultMode2,
+      "resultMode",
+      "events"
+    );
+    if (resultMode === "compact" && latestClass === void 0) {
+      throw new HTTPException21(400, {
+        message: "resultMode=compact requires latest"
+      });
+    }
     if (latestClass && ["includeTypes", "excludeTypes", "includeClasses", "excludeClasses"].some(
       (name) => c.req.query(name) !== void 0
     )) {
@@ -10724,19 +12057,39 @@ function registerSessionRoutes(app, deps) {
       compact ? 5e3 : mode === "monitoring" ? 250 : 2e3,
       mode === "monitoring" ? 40 : 500
     );
+    const dbPayloadMode = resultMode === "compact" ? "full" : payloadMode;
     const dbPage = await listSessionEventPage2(db, workspaceId, sessionId, {
       after,
       ...before !== void 0 ? { before } : {},
       limit,
       direction,
-      payloadMode,
+      payloadMode: dbPayloadMode,
       includeTypes,
       excludeTypes,
       includeClasses: latestClass ? [latestClass] : includeClasses,
       excludeClasses,
-      ...mode === "monitoring" ? { defaultExcludeTypes: SESSION_EVENT_RAW_DELTA_TYPES2 } : {}
+      ...mode === "monitoring" ? { defaultExcludeTypes: SESSION_EVENT_RAW_DELTA_TYPES2 } : {},
+      ...latestClass ? { authoritativeLatest: true } : {}
     });
     const events = dbPage.events;
+    if (resultMode === "compact") {
+      const event = events[0];
+      c.header("X-OpenGeni-Event-Result-Mode", "compact");
+      c.header("X-OpenGeni-Event-Result", event ? "found" : "not_found");
+      c.header("X-OpenGeni-Event-Mode", mode);
+      c.header("X-OpenGeni-Event-Direction", direction);
+      c.header("X-OpenGeni-Payload-Mode", "full");
+      c.header("X-OpenGeni-Forensic-Exact", "false");
+      if (!event) return c.json(null, 200);
+      const result = compactSessionEventResult2(
+        event,
+        latestClass,
+        dbPage.coveredSequence ?? { first: event.sequence, last: event.sequence }
+      );
+      c.header("X-OpenGeni-Covered-First", String(result.coveredSequence.first));
+      c.header("X-OpenGeni-Covered-Last", String(result.coveredSequence.last));
+      return c.json(result);
+    }
     const projected = compact ? coalesceSessionEventDeltas(events) : events;
     const page = boundSessionEventHttpPage(projected, {
       direction
@@ -11843,6 +13196,9 @@ function sessionAuthorizationOperationForHttp(method, pathname, sessionId) {
     return null;
   }
   if (suffix === "/pin" && verb === "PUT") return "session.pin.write";
+  if (/^\/mcp-servers\/[^/]+\/approval-policy$/.test(suffix) && verb === "PATCH") {
+    return "session.mcp.approval_policy.write";
+  }
   if (suffix === "/lineage" && verb === "GET") return "session.lineage.read";
   if (suffix === "/codex-account" && verb === "POST") {
     return "session.codex_account.write";
@@ -11934,7 +13290,7 @@ function eventEnumList(raw, schema, name) {
 }
 function sessionListQuery(query, allowCursor = true) {
   const parentSessionId = query.parentSessionId;
-  if (parentSessionId !== void 0 && parentSessionId !== "null" && !z2.string().uuid().safeParse(parentSessionId).success) {
+  if (parentSessionId !== void 0 && parentSessionId !== "null" && !z3.string().uuid().safeParse(parentSessionId).success) {
     throw new HTTPException21(400, {
       message: 'parentSessionId must be a session id or the literal "null"'
     });
@@ -12001,6 +13357,32 @@ function commandConflictResponse(c, error) {
   }
   throw error;
 }
+async function loadEffectivePolicyContext(deps, workspaceId) {
+  const [workspaceServerIds, workspaceDefaultServerIds] = await Promise.all([
+    workspaceSessionToolPolicyServerIds2(deps.db, workspaceId, deps.settings),
+    workspaceSessionToolPolicyDefaultServerIds2(deps.db, workspaceId, deps.settings)
+  ]);
+  return { workspaceServerIds, workspaceDefaultServerIds };
+}
+async function withEffectivePolicy(deps, workspaceId, session) {
+  const policy = await loadEffectivePolicyContext(deps, workspaceId);
+  return sessionWithEffectiveToolPolicy2(
+    session,
+    policy.workspaceServerIds,
+    policy.workspaceDefaultServerIds
+  );
+}
+function mapLineageNodes(nodes, policy) {
+  return nodes.map((node) => ({
+    ...node,
+    session: sessionWithEffectiveToolPolicy2(
+      node.session,
+      policy.workspaceServerIds,
+      policy.workspaceDefaultServerIds
+    ),
+    children: mapLineageNodes(node.children, policy)
+  }));
+}
 
 // src/routes/social.ts
 import { CreateSocialConnectionRequest, CreateSocialPostRequest } from "@opengeni/contracts";
@@ -12011,7 +13393,7 @@ import {
   listSocialPosts as listSocialPosts2
 } from "@opengeni/db";
 import { HTTPException as HTTPException22 } from "hono/http-exception";
-import { z as z3 } from "zod";
+import { z as z5 } from "zod";
 import { requireAccessGrant as requireAccessGrant15 } from "@opengeni/core";
 function registerSocialRoutes(app, deps) {
   const { db } = deps;
@@ -12101,7 +13483,7 @@ function parseConnectionIds(raw) {
     return void 0;
   }
   const values = raw.split(",").map((value) => value.trim()).filter(Boolean);
-  const parsed = z3.array(z3.string().uuid()).safeParse(values);
+  const parsed = z5.array(z5.string().uuid()).safeParse(values);
   if (!parsed.success) {
     throw new HTTPException22(422, {
       message: "connectionIds must be a comma-separated list of UUIDs"
@@ -12132,6 +13514,7 @@ import {
   UpdateWorkspaceRequest,
   UpdateWorkspaceSettingsRequest,
   WORKSPACE_CONTROL_ACTOR_MAX_BYTES as WORKSPACE_CONTROL_ACTOR_MAX_BYTES2,
+  WorkspaceModelCatalogResponse as WorkspaceModelCatalogResponse2,
   WorkspaceInferenceControlRequest,
   Workspace,
   WorkspaceMember,
@@ -12156,11 +13539,12 @@ import {
   setWorkspaceDefaultRig,
   updateWorkspace,
   updateWorkspaceSettings,
-  upsertWorkspaceModelPolicy
+  upsertWorkspaceModelPolicy,
+  workspaceCodexSubscriptionActive
 } from "@opengeni/db";
 import { boundWorkspaceControlHttpPage } from "@opengeni/events";
 import { HTTPException as HTTPException23 } from "hono/http-exception";
-import { hasPermission as hasPermission3, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant16 } from "@opengeni/core";
+import { hasPermission as hasPermission4, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant16 } from "@opengeni/core";
 import { requireLimit as requireLimit7 } from "@opengeni/core";
 import {
   assertWorkspaceDeletable,
@@ -12168,6 +13552,237 @@ import {
   controlHumanWorkspace,
   resolveMemberSubjectId
 } from "@opengeni/core";
+
+// src/model-catalog.ts
+import {
+  configuredModels,
+  configuredProviders,
+  withCodexCatalogProvider
+} from "@opengeni/config";
+import {
+  ClientModel,
+  WorkspaceModelCatalogResponse,
+  evaluateWorkspaceModelPolicy
+} from "@opengeni/contracts";
+var MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS = 5 * 6e4;
+function projectClientModel(model) {
+  return ClientModel.parse({
+    id: model.id,
+    label: model.label,
+    provider: model.providerId,
+    providerLabel: model.providerLabel,
+    api: model.api,
+    ...model.contextWindowTokens === void 0 ? {} : { contextWindowTokens: model.contextWindowTokens },
+    schemaVersion: model.schemaVersion,
+    aliases: model.aliases,
+    deployment: model.deployment,
+    executionLimits: model.executionLimits,
+    credentialSource: model.credentialSource,
+    billing: model.billing,
+    capabilities: model.capabilities,
+    ...model.pricing === void 0 ? {} : { pricing: model.pricing },
+    definitionVersion: model.definitionVersion
+  });
+}
+function modelDefinitionRunnable(model) {
+  return model.capabilities.inputModalities.includes("text") && model.capabilities.outputModalities.includes("text") && model.capabilities.transports.sse.runnable;
+}
+function observedCredentialReadiness(input) {
+  if (!input.observation) {
+    return {
+      status: "not_ready",
+      reason: "prerequisites_missing",
+      basis: input.basis,
+      checkedAt: null
+    };
+  }
+  const checkedAtMs = Date.parse(input.observation.checkedAt);
+  if (!Number.isFinite(checkedAtMs)) {
+    return {
+      status: "error",
+      reason: "resolver_error",
+      basis: input.basis,
+      checkedAt: null
+    };
+  }
+  const checkedAt = new Date(checkedAtMs).toISOString();
+  if (Math.abs(input.nowMs - checkedAtMs) > input.maxAgeMs) {
+    return {
+      status: "not_ready",
+      reason: "observation_stale",
+      basis: input.basis,
+      checkedAt
+    };
+  }
+  if (input.observation.status === "ready") {
+    return { status: "ready", reason: null, basis: input.basis, checkedAt };
+  }
+  if (input.observation.status === "not_ready") {
+    return {
+      status: "not_ready",
+      reason: input.observation.reason === "needs_reauth" ? "needs_reauth" : "prerequisites_missing",
+      basis: input.basis,
+      checkedAt
+    };
+  }
+  return {
+    status: "error",
+    reason: "resolver_error",
+    basis: input.basis,
+    checkedAt
+  };
+}
+function credentialReadinessFor(input) {
+  const source = input.model.credentialSource;
+  if (source.kind === "connected_subscription") {
+    return input.codexSubscriptionActive ? { status: "ready", reason: null, basis: "connection", checkedAt: null } : {
+      status: "not_ready",
+      reason: "needs_reauth",
+      basis: "connection",
+      checkedAt: null
+    };
+  }
+  if (source.kind === "deployment" && source.mechanism === "api_key") {
+    return input.provider?.apiKey ? { status: "ready", reason: null, basis: "configuration", checkedAt: null } : {
+      status: "not_ready",
+      reason: "missing_credential",
+      basis: "configuration",
+      checkedAt: null
+    };
+  }
+  return observedCredentialReadiness({
+    observation: input.observation,
+    basis: source.kind === "workspace_connection" ? "connection" : "resolver",
+    nowMs: input.nowMs,
+    maxAgeMs: input.maxAgeMs
+  });
+}
+function isXaiGrokModel(model) {
+  return model.providerId === "xai" && model.id.startsWith("xai/grok-");
+}
+function observationTimestamp(observation) {
+  if (!observation || typeof observation.checkedAt !== "string") {
+    return { checkedAt: null, checkedAtMs: null };
+  }
+  const checkedAtMs = Date.parse(observation.checkedAt);
+  if (!Number.isFinite(checkedAtMs)) {
+    return { checkedAt: null, checkedAtMs: null };
+  }
+  return { checkedAt: new Date(checkedAtMs).toISOString(), checkedAtMs };
+}
+function xaiGrokAvailabilityFor(input) {
+  const { checkedAt, checkedAtMs } = observationTimestamp(input.observation);
+  const freshSuccessfulObservation = input.observation?.status === "available" && input.observation.reason === null && checkedAtMs !== null && checkedAtMs <= input.nowMs && input.nowMs - checkedAtMs <= input.maxAgeMs;
+  if (freshSuccessfulObservation) {
+    return {
+      status: "available",
+      selectable: true,
+      reason: null,
+      checkedAt
+    };
+  }
+  return {
+    status: "unavailable",
+    selectable: false,
+    reason: input.observation?.status === "unavailable" ? input.observation.reason ?? "provider_unhealthy" : "provider_unhealthy",
+    checkedAt
+  };
+}
+function availabilityFor(input) {
+  if (!modelDefinitionRunnable(input.model)) {
+    return {
+      status: "unavailable",
+      selectable: false,
+      reason: "unsupported",
+      checkedAt: null
+    };
+  }
+  if (input.credentialReadiness.status !== "ready") {
+    return {
+      status: "unavailable",
+      selectable: false,
+      reason: input.credentialReadiness.reason === "missing_credential" ? "missing_credential" : input.credentialReadiness.reason === "needs_reauth" ? "needs_reauth" : "credential_not_ready",
+      checkedAt: input.credentialReadiness.checkedAt
+    };
+  }
+  if (!evaluateWorkspaceModelPolicy(input.policy, {
+    providerId: input.model.providerId,
+    modelId: input.model.id
+  }).allowed) {
+    return {
+      status: "unavailable",
+      selectable: false,
+      reason: "policy_blocked",
+      checkedAt: null
+    };
+  }
+  if (isXaiGrokModel(input.model)) {
+    return xaiGrokAvailabilityFor({
+      observation: input.observation,
+      nowMs: input.nowMs,
+      maxAgeMs: input.maxAgeMs
+    });
+  }
+  if (!input.observation) {
+    return { status: "unknown", selectable: true, reason: null, checkedAt: null };
+  }
+  if (input.observation.status === "unavailable") {
+    return {
+      status: "unavailable",
+      selectable: false,
+      reason: input.observation.reason ?? "provider_unhealthy",
+      checkedAt: input.observation.checkedAt
+    };
+  }
+  return {
+    status: input.observation.status,
+    selectable: true,
+    reason: null,
+    checkedAt: input.observation.checkedAt
+  };
+}
+function buildWorkspaceModelCatalog(input) {
+  const catalogSettings = input.settings.codexSubscriptionEnabled ? withCodexCatalogProvider(input.settings) : input.settings;
+  const providers = new Map(
+    configuredProviders(catalogSettings).map((provider) => [provider.id, provider])
+  );
+  const requestedNowMs = input.now?.getTime();
+  const nowMs = typeof requestedNowMs === "number" && Number.isFinite(requestedNowMs) ? requestedNowMs : Date.now();
+  const maxAgeMs = typeof input.credentialReadinessMaxAgeMs === "number" && Number.isFinite(input.credentialReadinessMaxAgeMs) && input.credentialReadinessMaxAgeMs >= 0 ? input.credentialReadinessMaxAgeMs : MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS;
+  const models = configuredModels(catalogSettings).map((model) => {
+    const provider = providers.get(model.providerId);
+    const credentialReadiness = credentialReadinessFor({
+      model,
+      provider,
+      codexSubscriptionActive: input.codexSubscriptionActive,
+      observation: input.credentialReadinessObservations?.[model.definitionVersion],
+      nowMs,
+      maxAgeMs
+    });
+    return {
+      ...projectClientModel(model),
+      credentialReadiness,
+      availability: availabilityFor({
+        model,
+        credentialReadiness,
+        policy: input.policy,
+        observation: input.observations?.[model.definitionVersion],
+        nowMs,
+        maxAgeMs
+      })
+    };
+  });
+  return WorkspaceModelCatalogResponse.parse({ models });
+}
+
+// src/routes/workspaces.ts
+import { canonicalizeConfiguredModelId } from "@opengeni/config";
+function canonicalWorkspacePolicyModelIds(settings, modelIds) {
+  if (modelIds === null || modelIds === void 0) {
+    return null;
+  }
+  return [...new Set(modelIds.map((modelId) => canonicalizeConfiguredModelId(settings, modelId)))];
+}
 function registerWorkspaceRoutes(app, deps) {
   app.get("/v1/access/me", async (c) => {
     return c.json(await requireAccessContext2(c, deps));
@@ -12176,7 +13791,7 @@ function registerWorkspaceRoutes(app, deps) {
     const context = await requireAccessContext2(c, deps);
     const readableWorkspaceIds = [
       ...new Set(
-        context.workspaceGrants.filter((grant) => hasPermission3(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
+        context.workspaceGrants.filter((grant) => hasPermission4(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
       )
     ];
     if (readableWorkspaceIds.length > 0) {
@@ -12244,6 +13859,24 @@ function registerWorkspaceRoutes(app, deps) {
     const workspace = await updateWorkspaceSettings(deps.db, workspaceId, parsed.data);
     return c.json(Workspace.parse(workspace));
   });
+  app.get("/v1/workspaces/:workspaceId/model-catalog", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant16(c, deps, workspaceId, "workspace:read");
+    const [policy, codexSubscriptionActive] = await Promise.all([
+      getWorkspaceModelPolicy(deps.db, workspaceId),
+      workspaceCodexSubscriptionActive(deps.db, deps.settings, workspaceId)
+    ]);
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      WorkspaceModelCatalogResponse2.parse(
+        buildWorkspaceModelCatalog({
+          settings: deps.settings,
+          policy,
+          codexSubscriptionActive
+        })
+      )
+    );
+  });
   app.get("/v1/workspaces/:workspaceId/model-policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant16(c, deps, workspaceId, "workspace:read");
@@ -12261,7 +13894,7 @@ function registerWorkspaceRoutes(app, deps) {
       accountId: grant.accountId,
       workspaceId,
       allowedProviders: payload.allowedProviders ?? null,
-      allowedModels: payload.allowedModels ?? null
+      allowedModels: canonicalWorkspacePolicyModelIds(deps.settings, payload.allowedModels)
     });
     return c.json(policy);
   });
@@ -12619,20 +14252,13 @@ function createApp(deps) {
         deploymentRevision: deps.settings.deploymentRevision,
         apiContractRevision: OPENGENI_API_CONTRACT_REVISION,
         ...deps.settings.serverVersion ? { serverVersion: deps.settings.serverVersion } : {},
-        defaultModel: deps.settings.openaiModel,
+        defaultModel: canonicalizeConfiguredModelId2(deps.settings, deps.settings.openaiModel),
         allowedModels: configuredAllowedModels(deps.settings),
         // Provider-grouped model list for the picker. configuredModels() carries the
         // union of the built-in allow-list and every registry provider's models, in
         // selection order (default model first); project each to the client-safe
         // ClientModel shape (ConfiguredModel.providerId → ClientModel.provider).
-        models: configuredModels(deps.settings).map((model) => ({
-          id: model.id,
-          label: model.label,
-          provider: model.providerId,
-          providerLabel: model.providerLabel,
-          api: model.api,
-          ...model.contextWindowTokens === void 0 ? {} : { contextWindowTokens: model.contextWindowTokens }
-        })),
+        models: configuredModels2(deps.settings).map(projectClientModel),
         defaultReasoningEffort: deps.settings.openaiReasoningEffort,
         allowedReasoningEfforts: configuredAllowedReasoningEfforts(deps.settings),
         mcpServers: deps.settings.mcpServers.map((server) => ({
@@ -12654,6 +14280,15 @@ function createApp(deps) {
   });
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    let boundedRequest;
+    try {
+      boundedRequest = await boundedMcpRequest(c.req.raw);
+    } catch (error) {
+      if (error instanceof McpPayloadTooLargeError2) {
+        throw new HTTPException24(413, { message: "MCP request body exceeds the safety limit" });
+      }
+      throw error;
+    }
     const grant = await requireMcpAccessGrant(c, routeDeps, workspaceId);
     const toolspaceGrant = isToolspaceGrant(routeDeps.settings, grant);
     const boundSessionId = grant.metadata?.sessionId;
@@ -12677,7 +14312,17 @@ function createApp(deps) {
         throw error;
       }
     }
-    const toolspace = toolspaceGrant ? await prepareToolspaceMcpSurface({ deps: routeDeps, grant }) : null;
+    let toolspace = null;
+    if (toolspaceGrant) {
+      try {
+        toolspace = await prepareToolspaceMcpSurface({ deps: routeDeps, grant });
+      } catch (error) {
+        if (error instanceof McpPayloadTooLargeError2) {
+          throw new HTTPException24(413, { message: "MCP tool list exceeds the safety limit" });
+        }
+        throw error;
+      }
+    }
     const workspace = await getWorkspace2(routeDeps.db, workspaceId);
     const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
     const transport = new WebStandardStreamableHTTPServerTransport2({
@@ -12690,7 +14335,7 @@ function createApp(deps) {
     });
     try {
       await mcp.connect(transport);
-      return await transport.handleRequest(c.req.raw);
+      return await transport.handleRequest(boundedRequest);
     } finally {
       await toolspace?.close().catch(() => void 0);
     }
@@ -12718,7 +14363,7 @@ function createApp(deps) {
 }
 async function requireMcpAccessGrant(c, deps, workspaceId) {
   const grant = await requireAccessGrant17(c, deps, workspaceId);
-  if (hasPermission4(grant.permissions, "workspace:read")) {
+  if (hasPermission5(grant.permissions, "workspace:read")) {
     return grant;
   }
   if (isToolspaceGrant(deps.settings, grant)) {
@@ -12757,6 +14402,9 @@ function httpStatusForError(error) {
   if (error instanceof HTTPException24) {
     return error.status;
   }
+  if (error instanceof McpPayloadTooLargeError2) {
+    return 413;
+  }
   return 500;
 }
 function readinessChecks(deps) {
@@ -12946,6 +14594,14 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/files\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/files/:id"
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/artifacts\/[^/]+\/content$/,
+    label: "/v1/workspaces/:workspaceId/artifacts/:id/content"
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/artifacts\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/artifacts/:id"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/api-keys$/,
     label: "/v1/workspaces/:workspaceId/api-keys"
@@ -13202,4 +14858,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-EYYTFA7N.js.map
+//# sourceMappingURL=chunk-QOYQBYHM.js.map