@opengeni/api-router 3.0.1 → 4.0.0

package/src/routes/rigs.ts

@@ -51,7 +51,7 @@ async function parseRigRequest<T>(c: Context, schema: ZodType<T>, label: string)
   throw new ApiHttpError(422, {
     code: "validation_failed",
     message: imageOverrideUnsupported
-      ? "Rig base-image overrides are not supported; Rigs use the deployment-managed platform sandbox."
+      ? "Sandbox Environment base-image overrides are not supported; Sandbox Environments use the deployment-managed platform sandbox."
       : `Invalid ${label}.`,
     retryable: false,
     details: {
@@ -77,7 +77,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
     const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId, permission);
     const rigId = c.req.param("rigId");
     if (!rigId) {
-      throw new HTTPException(400, { message: "rig id is required" });
+      throw new HTTPException(400, { message: "sandbox environment id is required" });
     }
     const rig = await requireRigForApi(db, authorization.grant, rigId);
     if (
@@ -126,7 +126,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
       // The verifying transition already committed. Keep its deterministic
       // attempt identity retryable instead of reporting an opaque 5xx after a
       // durable mutation or inventing a second attempt after an ambiguous start.
-      deps.observability?.warn("rig change verification start failed", {
+      deps.observability?.warn("sandbox environment change verification start failed", {
         workspaceId,
         changeId,
         attempt,
@@ -163,11 +163,14 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
       // Creation already committed. The rig remains fully usable through its
       // runtime setup fallback and can be re-verified explicitly; never turn a
       // successful create into an unretryable 5xx because Temporal was down.
-      deps.observability?.warn("initial rig provider-image verification start failed", {
-        workspaceId,
-        versionId,
-        error: error instanceof Error ? error.message : String(error),
-      });
+      deps.observability?.warn(
+        "initial sandbox environment provider-image verification start failed",
+        {
+          workspaceId,
+          versionId,
+          error: error instanceof Error ? error.message : String(error),
+        },
+      );
       return false;
     }
   }
@@ -183,7 +186,11 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
     const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
     const grant = authorization.grant;
     requirePermission(grant, "rigs:manage");
-    const payload = await parseRigRequest(c, CreateRigRequest, "Rig create request");
+    const payload = await parseRigRequest(
+      c,
+      CreateRigRequest,
+      "Sandbox Environment create request",
+    );
     const allowOrganization =
       payload.scope === "organization" &&
       authorization.accountGrant?.permissions.includes("account:admin") === true;
@@ -222,7 +229,11 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "missing permission: account:admin",
       });
     }
-    const payload = await parseRigRequest(c, UpdateRigRequest, "Rig update request");
+    const payload = await parseRigRequest(
+      c,
+      UpdateRigRequest,
+      "Sandbox Environment update request",
+    );
     return c.json(await updateRigForApi({ db }, grant, rig, payload, { allowOrganization }));
   });
 
@@ -254,7 +265,11 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/versions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const { grant, rig } = await requireRigMutation(c, workspaceId, "rigs:manage");
-    const payload = await parseRigRequest(c, RigDefinitionEditPayload, "Rig version request");
+    const payload = await parseRigRequest(
+      c,
+      RigDefinitionEditPayload,
+      "Sandbox Environment version request",
+    );
     const version = await createRigVersionForApi({ db }, grant, rig, payload);
     const started = await tryStartInitialVersionVerification(rig.workspaceId, version.id);
     if (!started) c.header("OpenGeni-Rig-Verification", "deferred");
@@ -289,7 +304,11 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/changes", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const { grant, rig } = await requireRigMutation(c, workspaceId, "rigs:use");
-    const request = await parseRigRequest(c, ProposeRigChangeRequest, "Rig change request");
+    const request = await parseRigRequest(
+      c,
+      ProposeRigChangeRequest,
+      "Sandbox Environment change request",
+    );
     const change = await proposeRigChangeForApi({ db }, grant, rig, request);
     const verification = await startChangeVerification(rig.workspaceId, change.id);
     if (!verification.started) c.header("OpenGeni-Rig-Verification", "deferred");
@@ -336,7 +355,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const { rig } = await requireRigMutation(c, workspaceId, "rigs:use");
     if (!rig.activeVersion) {
-      return c.json({ error: "rig has no active version" }, 422);
+      return c.json({ error: "sandbox environment has no active version" }, 422);
     }
     await startVersionVerification(rig.workspaceId, rig.activeVersion.id);
     return c.json({ ok: true, versionId: rig.activeVersion.id }, 202);

package/src/routes/scheduled-tasks.ts

@@ -27,6 +27,7 @@ import {
   syncCreatedScheduledTask,
   syncUpdatedScheduledTask,
   updateScheduledTaskForApi,
+  triggerScheduledTaskForGrant,
   validateScheduledTaskMachineTarget,
   validateScheduledTaskTarget,
   validatedScheduledTaskUpdate,
@@ -152,7 +153,7 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     });
     const task = await updateScheduledTaskForApi(
       db,
-      workspaceId,
+      grant,
       taskId,
       update,
       payload.agentLearning
@@ -168,7 +169,7 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const previous = await captureScheduledTaskRestoreState(db, existing);
-    const task = await updateScheduledTaskForApi(db, workspaceId, existing.id, {
+    const task = await updateScheduledTaskForApi(db, grant, existing.id, {
       status: "paused",
     });
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
@@ -203,7 +204,7 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       sessionAuthorization: deps.sessionAuthorization,
       authorizationSurface: "http",
     });
-    const task = await updateScheduledTaskForApi(db, workspaceId, existing.id, update);
+    const task = await updateScheduledTaskForApi(db, grant, existing.id, update);
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
     return c.json(scheduledTaskForGrant(task, grant));
   });
@@ -262,7 +263,7 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
         ? manualScheduledTaskTriggerUsageKey(workspaceId, task.id, triggerToken)
         : `knowledge-source-sync:manual:${workspaceId}:${task.id}:${triggerToken}`;
     const triggerWorkflowId = manualScheduledTaskTriggerWorkflowId(task.id, triggerToken);
-    await workflowClient.triggerScheduledTask({
+    await triggerScheduledTaskForGrant(db, grant, workflowClient, {
       task,
       agentRunUsageIdempotencyKey,
       triggerWorkflowId,
@@ -288,9 +289,8 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     await deleteScheduledTaskWithDurableCleanup(deps, {
-      workspaceId,
+      grant,
       taskId: c.req.param("taskId"),
-      subjectId: grant.subjectId,
     });
     return c.json({ ok: true });
   });

package/src/routes/sessions.ts

@@ -1,7 +1,14 @@
 import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
+import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
+import { SessionMessageSearchRequest } from "@opengeni/contracts";
 import { scheduledSessionIds } from "@opengeni/db";
 import { withSiteSessionOrigin } from "@opengeni/core";
 import { resolveSiteSessionOrigin } from "../site-session-origin";
+import { SandboxRecoveryRequest } from "@opengeni/contracts";
+import { getManagedHumanSandboxRecovery, consentManagedHumanSandboxRecovery } from "@opengeni/core";
+import { SandboxRecoveryConflictError } from "@opengeni/db";
+import { codexAccountJson } from "./codex";
+import { getSessionCodexAccounts } from "@opengeni/db";
 import {
   AcknowledgeStreamRequest,
   ApplySessionGoalRevisionRequest,
@@ -43,6 +50,7 @@ import {
   RenewSessionRealtimeRequest,
   SyncSessionRealtimeLedgerRequest,
   SessionControlRequest,
+  SessionRetryRequest,
   SESSION_EVENT_RAW_DELTA_TYPES,
   SessionEventPayloadMode,
   SessionEventReadDirection,
@@ -257,6 +265,7 @@ import {
   type ResolvedSessionAuthorization,
 } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
+import { SessionRetryConflictError } from "@opengeni/db";
 import {
   attachViewer,
   detachViewer,
@@ -274,6 +283,7 @@ import { buildSessionCodexRealtimeBroker, CodexRealtimeBrokerError } from "../co
 import {
   acceptSessionUserMessage,
   controlHumanSessionWorkstream,
+  retryFailedSession,
   createSessionForRequest,
   deleteHumanQueuePrompt,
   editHumanQueuePrompt,
@@ -310,6 +320,7 @@ import {
 import { publishSandboxFileArtifact } from "../sandbox-file-artifacts";
 import { ApiHttpError } from "../http/api-error";
 import { observeWorkDiscovery, summarizeWorkDiscoveryRows } from "../work-discovery-observability";
+import { recordAcceptedApiAdmission } from "../admission-trace";
 
 type SessionRouteDeps = ApiRouteDeps & Pick<ViewerServices, "establishSandboxSession">;
 
@@ -681,6 +692,59 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     }
   });
 
+  app.get("/v1/workspaces/:workspaceId/session-message-search", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "sessions:read",
+    );
+    const grant = authorization.grant;
+    // A single-session filter is not authority: both searches use the complete
+    // live host/agent list scope, plus ordinary private/archive/RLS boundaries.
+    let authorizationScope;
+    try {
+      authorizationScope = await requireSessionAuthorizationListScope(deps, grant, "http");
+    } catch (error) {
+      throw sessionAuthorizationHttpError(error);
+    }
+    const raw = c.req.query();
+    const parsed = SessionMessageSearchRequest.safeParse({
+      ...raw,
+      ...(raw.limit !== undefined ? { limit: Number(raw.limit) } : {}),
+    });
+    if (!parsed.success)
+      throw new HTTPException(400, { message: "Invalid session message search request" });
+    try {
+      return c.json(
+        await searchSessionMessagesForSubject(
+          db,
+          workspaceId,
+          parsed.data,
+          {
+            subjectId: grant.subjectId,
+            ...(authorizationScope ? { authorizationScope } : {}),
+            personalWorkspaceOwnerException: hasVerifiedOwningUserAuthorization(authorization),
+          },
+          { signal: c.req.raw.signal },
+        ),
+      );
+    } catch (error) {
+      if (error instanceof SessionListAccessError)
+        throw new HTTPException(403, { message: error.message });
+      if (error instanceof SessionMessageSearchCursorError)
+        throw new HTTPException(400, { message: error.message });
+      // Clients are told to cancel superseded searches, so an abort here is a
+      // routine client disconnect, never a server failure. Match the existing
+      // client-gone convention (mcp/request-abort.ts): 499 with an empty body,
+      // which a departed client never reads and monitors never count as 5xx.
+      if (c.req.raw.signal.aborted || (error instanceof Error && error.name === "AbortError"))
+        return new Response(null, { status: 499 });
+      throw error;
+    }
+  });
+
   app.get("/v1/workspaces/:workspaceId/sessions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const authorization = await requireAccessGrantAuthorization(
@@ -708,6 +772,8 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
         ...(query.search ? { search: query.search } : {}),
         ...(query.pinsOnly ? { pinsOnly: true } : {}),
         ...(query.archivedOnly ? { archivedOnly: true } : {}),
+        ...(query.sortBy ? { sortBy: query.sortBy } : {}),
+        ...(query.archiveStatus ? { archiveStatus: query.archiveStatus } : {}),
         ...(query.parentSessionId !== undefined ? { parentSessionId: query.parentSessionId } : {}),
         ...(query.channelId !== undefined ? { channelId: query.channelId } : {}),
         ...(query.originSiteId ? { originSiteId: query.originSiteId } : {}),
@@ -1944,6 +2010,31 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     });
   });
 
+  app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/codex-accounts", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "sessions:read");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    // authorizeSessionHttp has already enforced private-session and agent scope.
+    const projection = await getSessionCodexAccounts(db, workspaceId, c.req.param("sessionId"));
+    if (!projection) throw new HTTPException(404, { message: "session not found" });
+    const activeAccountId = projection.rotation?.activeCredentialId ?? null;
+    return c.json({
+      accounts: projection.accounts.map((account) => codexAccountJson(account)),
+      activeAccountId,
+      settings: {
+        rotationEnabled: projection.rotation?.rotationEnabled ?? false,
+        rotationStrategy: "sharded",
+        activeCredentialId: activeAccountId,
+      },
+      currentSelection: projection.currentSelection,
+      currentAccount: projection.currentAccount
+        ? codexAccountJson(projection.currentAccount)
+        : null,
+      pinnedAccountId: projection.pinnedAccountId,
+      lastAccountId: projection.lastAccountId,
+    });
+  });
+
   // Pin (or unpin) the session's Codex account. body { target: "auto" | "<id>" }:
   // "auto" clears the pin (the session follows the workspace active pointer); a
   // uuid pins the session to that specific account. Overrides a capacity-blocked
@@ -2569,10 +2660,17 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
 
   app.delete("/v1/workspaces/:workspaceId/sessions/:sessionId/goal", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "sessions:control");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
-    const { event } = await clearSessionGoal(db, workspaceId, sessionId);
+    const { event } = await clearSessionGoal(db, workspaceId, sessionId, {
+      actor: grant.principalKind === "agent_attempt" ? "agent" : "api",
+    }).catch((error: unknown) => {
+      if (error instanceof SessionControlConflictError) {
+        throw new HTTPException(409, { message: error.message, cause: error });
+      }
+      throw error;
+    });
     if (event) {
       try {
         await bus.publish(workspaceId, sessionId, [event]);
@@ -3059,6 +3157,112 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     }
   });
 
+  app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/sandbox-recovery", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+    try {
+      return c.json(
+        await getManagedHumanSandboxRecovery(
+          deps,
+          authorization,
+          workspaceId,
+          c.req.param("sessionId"),
+        ),
+      );
+    } catch (error) {
+      throw sessionTenancyHttpError(error);
+    }
+  });
+
+  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/sandbox-recovery", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const sessionId = c.req.param("sessionId");
+    const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+    const parsed = SandboxRecoveryRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) throw new HTTPException(400, { message: "invalid checkpoint consent" });
+    let consentCommitted = false;
+    try {
+      const receipt = await consentManagedHumanSandboxRecovery(
+        deps,
+        authorization,
+        workspaceId,
+        sessionId,
+        parsed.data,
+      );
+      consentCommitted = true;
+      const projection = await getManagedHumanSandboxRecovery(
+        deps,
+        authorization,
+        workspaceId,
+        sessionId,
+      );
+      if (
+        projection.operationId === receipt.operationId &&
+        projection.status === "consent_accepted"
+      ) {
+        // Establish/verify only. No failed-turn Retry, Send, tool callback or
+        // command replay. The ordinary cold->warming election owns creation.
+        const session = await getSession(db, workspaceId, sessionId);
+        if (session) {
+          try {
+            await withChannelARead(
+              channelAServices,
+              {
+                accountId: authorization.grant.accountId,
+                workspaceId,
+                session,
+                subjectId: authorization.grant.subjectId,
+              },
+              async () => undefined,
+            );
+          } catch {
+            // Consent committed. Never turn a provider failure into a false
+            // rejection of consent or leak native provider bindings/messages.
+          }
+        }
+      }
+      return c.json({
+        ...receipt,
+        recovery: await getManagedHumanSandboxRecovery(deps, authorization, workspaceId, sessionId),
+      });
+    } catch (error) {
+      if (consentCommitted) {
+        // A later authorization/read failure cannot revoke the committed
+        // receipt. Return no session state, checkpoint or provider details.
+        return c.json(
+          {
+            code: "upstream_unavailable",
+            message:
+              "Recovery status could not be confirmed. Check status without resubmitting consent.",
+            outcomeUnknown: true,
+            retryable: false,
+          },
+          503,
+        );
+      }
+      if (error instanceof SandboxRecoveryConflictError)
+        return c.json({ code: error.code, message: error.message }, 409);
+      if (error instanceof SessionCommandIdempotencyError) return commandConflictResponse(c, error);
+      throw sessionTenancyHttpError(error);
+    }
+  });
+
+  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/retry", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:control");
+    const parsed = SessionRetryRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) throw new HTTPException(400, { message: "invalid session retry request" });
+    try {
+      return c.json(
+        await retryFailedSession(deps, grant, workspaceId, c.req.param("sessionId"), parsed.data),
+      );
+    } catch (error) {
+      if (error instanceof SessionRetryConflictError)
+        return c.json({ code: error.code, message: error.message }, 409);
+      return commandConflictResponse(c, error);
+    }
+  });
+
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/control", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:control");
@@ -3121,10 +3325,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
         reasoningEffort: payload.reasoningEffort ?? null,
         latencyMode: payload.latencyMode ?? null,
         mcpCredentialUpdates: payload.mcpCredentialUpdates ?? [],
-        connectionAuthorities: payload.connectionAuthorities,
-        ...(payload.selectedHostMcpDelegations
-          ? { selectedHostMcpDelegations: payload.selectedHostMcpDelegations }
-          : {}),
+        connectionAccounts: payload.connectionAccounts,
         ...(payload.personalResourceAttachment
           ? { personalResourceAttachment: payload.personalResourceAttachment }
           : {}),
@@ -3140,6 +3341,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     } catch (error) {
       return commandConflictResponse(c, error);
     }
+    recordAcceptedApiAdmission(deps.observability, result);
     return c.json(result, 202);
   });
 
@@ -3163,6 +3365,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     } catch (error) {
       return commandConflictResponse(c, error);
     }
+    recordAcceptedApiAdmission(deps.observability, result);
     return c.json(result, 202);
   });
 
@@ -3206,10 +3409,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
           reasoningEffort: event.payload.reasoningEffort ?? null,
           latencyMode: event.payload.latencyMode ?? null,
           mcpCredentialUpdates: event.payload.mcpCredentialUpdates ?? [],
-          connectionAuthorities: event.payload.connectionAuthorities,
-          ...(event.payload.selectedHostMcpDelegations
-            ? { selectedHostMcpDelegations: event.payload.selectedHostMcpDelegations }
-            : {}),
+          connectionAccounts: event.payload.connectionAccounts,
           ...(event.payload.personalResourceAttachment
             ? { personalResourceAttachment: event.payload.personalResourceAttachment }
             : {}),
@@ -3225,6 +3425,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       } catch (error) {
         return commandConflictResponse(c, error);
       }
+      recordAcceptedApiAdmission(deps.observability, result);
       return c.json(result.accepted, 202);
     }
 
@@ -4566,6 +4767,7 @@ export function sessionAuthorizationOperationForHttp(
   if (suffix === "/lineage" && verb === "GET") return "session.lineage.read";
   if (suffix === "/background-commands" && verb === "GET") return "session.read";
   if (suffix === "/model-context" && verb === "GET") return "session.read";
+  if (suffix === "/codex-accounts" && verb === "GET") return "session.read";
   if (/^\/background-commands\/[^/]+$/.test(suffix) && verb === "DELETE") {
     return "session.control";
   }
@@ -4632,6 +4834,8 @@ export function sessionAuthorizationOperationForHttp(
   // acceptSessionUserMessageWithOutcome after the body is parsed.
   if (suffix === "/composer-draft/submit" && verb === "POST") return "session.append";
   if (suffix === "/control" && verb === "POST") return "session.control";
+  if (suffix === "/retry" && verb === "POST") return "session.control";
+  if (suffix === "/sandbox-recovery" && ["GET", "POST"].includes(verb)) return "session.control";
   if (suffix === "/steer" && verb === "POST") return "session.steer";
   if (suffix === "/human-input-requests" && verb === "GET") {
     return "session.human_input.read";
@@ -4795,7 +4999,7 @@ function eventEnumList<T extends string>(
   });
 }
 
-function sessionListQuery(
+export function sessionListQuery(
   query: Record<string, string>,
   allowCursor = true,
 ): {
@@ -4806,6 +5010,8 @@ function sessionListQuery(
   search: string | undefined;
   pinsOnly: boolean;
   archivedOnly: boolean;
+  sortBy: "updatedAt" | "createdAt" | "name" | undefined;
+  archiveStatus: "active" | "archived" | "all" | undefined;
   channelId: string | null | undefined;
   createdBy: { kind: "subject" | "service"; subjectId: string } | undefined;
   updatedFrom: Date | undefined;
@@ -4852,6 +5058,20 @@ function sessionListQuery(
     throw new HTTPException(400, { message: 'archivedOnly must be the literal "true"' });
   }
   const archivedOnly = query.archivedOnly === "true";
+  const sortBy = z.enum(["updatedAt", "createdAt", "name"]).optional().safeParse(query.sortBy);
+  const archiveStatus = z
+    .enum(["active", "archived", "all"])
+    .optional()
+    .safeParse(query.archiveStatus);
+  if (!sortBy.success || !archiveStatus.success) {
+    throw new HTTPException(400, { message: "Invalid session sortBy or archiveStatus" });
+  }
+  if (archivedOnly && archiveStatus.data !== undefined && archiveStatus.data !== "archived") {
+    throw new HTTPException(400, { message: "archivedOnly conflicts with archiveStatus" });
+  }
+  if (pinsOnly && archiveStatus.data === "archived") {
+    throw new HTTPException(400, { message: "pinsOnly cannot be combined with archived status" });
+  }
   const channelId = query.channelId;
   if (
     channelId !== undefined &&
@@ -4956,6 +5176,8 @@ function sessionListQuery(
     search: search || undefined,
     pinsOnly,
     archivedOnly,
+    sortBy: sortBy.data,
+    archiveStatus: archiveStatus.data,
     channelId: channelId === undefined ? undefined : channelId === "null" ? null : channelId,
     createdBy:
       createdByKind && createdBySubjectId

package/src/routes/skill-content.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { SkillFile, type SkillWriteReceipt } from "@opengeni/contracts";
+import { readSkillRemovalScope } from "@opengeni/db";
 import {
   approveSkill,
   rejectSkill,
@@ -33,6 +34,7 @@ const saveRequest = z
   .strict();
 const revisionRequest = z
   .object({
+    removalOperationId: z.uuid().optional(),
     operationId: z.uuid(),
     revisionId: z.uuid(),
     expectedRevisionId: z.uuid().nullable(),
@@ -180,8 +182,22 @@ export function registerSkillContentRoutes(app: Hono, deps: ApiRouteDeps): void
         { accountId: access.grant.accountId, workspaceId, subjectId: access.grant.subjectId },
         skillId,
       );
-      if (!current) throw new HTTPException(404, { message: "Skill not found" });
-      authorizePreferenceRegistryScopeMutation(access, current.scope);
+      const scope =
+        current?.scope ??
+        (operation === "approve" && request.removalOperationId
+          ? await readSkillRemovalScope(
+              deps.db,
+              {
+                accountId: access.grant.accountId,
+                workspaceId,
+                subjectId: access.grant.subjectId,
+              },
+              skillId,
+              request.operationId,
+            )
+          : null);
+      if (!scope) throw new HTTPException(404, { message: "Skill not found" });
+      authorizePreferenceRegistryScopeMutation(access, scope);
       const apply =
         operation === "approve"
           ? approveSkill
@@ -214,7 +230,7 @@ async function skillMutation(run: () => Promise<SkillWriteReceipt>): Promise<Ski
     let current: unknown = error;
     for (let depth = 0; depth < 4 && current && typeof current === "object"; depth++) {
       const candidate = current as { code?: unknown; cause?: unknown };
-      if (candidate.code === "23505" || candidate.code === "40001")
+      if (candidate.code === "23505" || candidate.code === "40001" || candidate.code === "55P03")
         throw new HTTPException(409, {
           message:
             "Skill changed or this operation key was reused. Reload and reconcile the change.",

package/src/routes/social.ts

@@ -2,8 +2,10 @@ import {
   CreateSocialConnectionRequest,
   CreateSocialPostRequest,
   OAuthStartResponse,
+  OrganizationIntegrationDeniedError,
   SocialOAuthStartRequest,
 } from "@opengeni/contracts";
+import { withOrganizationIntegrationAcquisition } from "@opengeni/db/organization-integration-policy";
 import {
   createSocialConnection,
   createSocialPost,
@@ -47,19 +49,25 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
     const payload = CreateSocialConnectionRequest.parse(await c.req.json());
     try {
       return c.json(
-        await createSocialConnection(db, {
-          accountId: grant.accountId,
-          workspaceId,
-          provider: payload.provider,
-          accountHandle: payload.accountHandle,
-          accountName: payload.accountName ?? null,
-          externalAccountId: payload.externalAccountId ?? null,
-          status: payload.status,
-          scopes: payload.scopes,
-          credentialRef: payload.credentialRef ?? null,
-          tokenMetadata: payload.tokenMetadata,
-          metadata: payload.metadata,
-        }),
+        await withOrganizationIntegrationAcquisition(
+          db,
+          { accountId: grant.accountId, workspaceId },
+          [payload.provider === "x" || payload.provider === "reddit" ? payload.provider : null],
+          (tx) =>
+            createSocialConnection(tx, {
+              accountId: grant.accountId,
+              workspaceId,
+              provider: payload.provider,
+              accountHandle: payload.accountHandle,
+              accountName: payload.accountName ?? null,
+              externalAccountId: payload.externalAccountId ?? null,
+              status: payload.status,
+              scopes: payload.scopes,
+              credentialRef: payload.credentialRef ?? null,
+              tokenMetadata: payload.tokenMetadata,
+              metadata: payload.metadata,
+            }),
+        ),
         201,
       );
     } catch (error) {
@@ -222,6 +230,9 @@ function parseConnectionIds(raw: string | undefined): string[] | undefined {
 }
 
 function socialHttpException(error: unknown): HTTPException {
+  if (error instanceof OrganizationIntegrationDeniedError) {
+    return new HTTPException(403, { message: error.message });
+  }
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
     return new HTTPException(404, { message });