@opengeni/core 0.8.0 → 0.11.1

package/dist/index.js

@@ -9,6 +9,7 @@ import {
   getSandbox as getSandbox2,
   listSandboxes,
   readActiveSandbox as readActiveSandbox2,
+  readLease,
   requireSession,
   setActiveSandbox
 } from "@opengeni/db";
@@ -21,8 +22,20 @@ import {
 import { HTTPException } from "hono/http-exception";
 
 // src/sandbox/routing.ts
-import { getSandbox, readActiveSandbox } from "@opengeni/db";
 import {
+  advanceWorkspaceGenerationForDirectRequest,
+  advanceWorkspaceGenerationForRetainedProcess,
+  getSandbox,
+  markWarmLeaseInstanceLost,
+  readActiveSandbox,
+  retainWorkspaceMutationProcess,
+  settleRetainedProcess,
+  verifyDirectWorkspaceMutationSettlement,
+  verifyRetainedProcessMutationSettlement
+} from "@opengeni/db";
+import { appendAndPublishEvents } from "@opengeni/events";
+import {
+  isProviderSandboxGoneDuringRoutedOperation,
   makeActiveBackendResolver,
   NatsControlRpc,
   RoutingSandboxSession
@@ -63,6 +76,129 @@ function routingEnabled(settings) {
 }
 function wrapChannelABoxWithRouting(services, ids, established) {
   const { db, settings, bus } = services;
+  const beforeMutation = async ({
+    op,
+    backend
+  }) => {
+    if (backend.sandboxId !== null || backend.leaseEpoch === void 0 || backend.providerInstanceId === void 0) {
+      return null;
+    }
+    if (backend.activeEpoch === void 0) {
+      throw new Error("API-direct workspace mutation resolved without an active route epoch");
+    }
+    return await advanceWorkspaceGenerationForDirectRequest(db, {
+      accountId: ids.accountId,
+      workspaceId: ids.workspaceId,
+      sessionId: ids.sessionId,
+      requestId: ids.directRequest.requestId,
+      holderId: ids.directRequest.holderId,
+      sandboxGroupId: ids.homeLease.sandboxGroupId,
+      expectedEpoch: backend.leaseEpoch,
+      expectedInstanceId: backend.providerInstanceId,
+      routeTargetId: backend.sandboxId,
+      routeEpoch: backend.activeEpoch,
+      operation: op
+    });
+  };
+  const afterMutation = async ({
+    op,
+    backend,
+    admission,
+    outcome,
+    retainedProcess
+  }) => {
+    if (admission === null) return;
+    if (!admission || typeof admission !== "object" || typeof admission.id !== "string" || typeof admission.workspaceGeneration !== "number" || backend.leaseEpoch === void 0 || backend.providerInstanceId === void 0 || backend.activeEpoch === void 0) {
+      throw new Error("API-direct workspace mutation settlement lacked its exact admission");
+    }
+    const exactAdmission = admission;
+    if (outcome === "resolved" && retainedProcess) {
+      await retainWorkspaceMutationProcess(db, {
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        processId: retainedProcess.id,
+        providerSessionId: retainedProcess.providerSessionId,
+        admissionId: exactAdmission.id,
+        admittedWorkspaceGeneration: exactAdmission.workspaceGeneration,
+        operation: op,
+        owner: {
+          kind: "direct",
+          requestId: ids.directRequest.requestId,
+          holderId: ids.directRequest.holderId,
+          sandboxGroupId: ids.homeLease.sandboxGroupId,
+          expectedEpoch: backend.leaseEpoch,
+          expectedInstanceId: backend.providerInstanceId,
+          routeTargetId: exactAdmission.routeTargetId,
+          routeEpoch: exactAdmission.routeEpoch
+        }
+      });
+      return;
+    }
+    await verifyDirectWorkspaceMutationSettlement(db, {
+      accountId: ids.accountId,
+      workspaceId: ids.workspaceId,
+      sessionId: ids.sessionId,
+      requestId: ids.directRequest.requestId,
+      holderId: ids.directRequest.holderId,
+      sandboxGroupId: ids.homeLease.sandboxGroupId,
+      expectedEpoch: backend.leaseEpoch,
+      expectedInstanceId: backend.providerInstanceId,
+      routeTargetId: exactAdmission.routeTargetId,
+      routeEpoch: exactAdmission.routeEpoch,
+      admission: exactAdmission,
+      operation: op,
+      outcome
+    });
+  };
+  const beforeProcessMutation = async ({
+    op,
+    process
+  }) => await advanceWorkspaceGenerationForRetainedProcess(db, {
+    accountId: ids.accountId,
+    workspaceId: ids.workspaceId,
+    sessionId: ids.sessionId,
+    processId: process.id,
+    operation: op
+  });
+  const afterProcessMutation = async ({
+    op,
+    process,
+    admission,
+    outcome
+  }) => {
+    if (!admission || typeof admission !== "object" || typeof admission.id !== "string" || typeof admission.workspaceGeneration !== "number") {
+      throw new Error("API retained-process mutation settlement lacked its exact admission");
+    }
+    await verifyRetainedProcessMutationSettlement(db, {
+      accountId: ids.accountId,
+      workspaceId: ids.workspaceId,
+      sessionId: ids.sessionId,
+      processId: process.id,
+      admission,
+      operation: op,
+      outcome
+    });
+  };
+  const settleProcess = async ({
+    backend,
+    process,
+    proof
+  }) => {
+    if (backend.sandboxId !== null || backend.leaseEpoch === void 0 || backend.providerInstanceId === void 0) {
+      return;
+    }
+    await settleRetainedProcess(db, {
+      accountId: ids.accountId,
+      workspaceId: ids.workspaceId,
+      sessionId: ids.sessionId,
+      processId: process.id,
+      outcome: proof.outcome,
+      exitCode: proof.exitCode,
+      reason: proof.reason,
+      idleGraceMs: settings.sandboxIdleGraceMs
+    });
+  };
   const resolver = makeActiveBackendResolver({
     workspaceId: ids.workspaceId,
     defaultBackend: established.session,
@@ -77,14 +213,61 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       } : null;
     },
     controlRpcFactory: controlRpcFactory(bus),
-    relay: relayConfigFromSettings(settings)
+    relay: relayConfigFromSettings(settings),
+    resolveDefaultBackend: async () => ({
+      session: established.session,
+      sandboxId: null,
+      kind: established.backendId,
+      leaseEpoch: ids.homeLease.leaseEpoch,
+      providerInstanceId: ids.homeLease.instanceId
+    })
   });
   const proxy = new RoutingSandboxSession({
+    defaultResolved: {
+      session: established.session,
+      sandboxId: null,
+      kind: established.backendId,
+      leaseEpoch: ids.homeLease.leaseEpoch,
+      providerInstanceId: ids.homeLease.instanceId
+    },
     readPointer: async () => {
+      if (!routingEnabled(settings)) {
+        return { activeSandboxId: null, activeEpoch: 0 };
+      }
       const pointer = await readActiveSandbox(db, ids.workspaceId, ids.sessionId);
       return pointer ?? { activeSandboxId: null, activeEpoch: 0 };
     },
-    resolveActiveBackend: resolver
+    resolveActiveBackend: resolver,
+    beforeMutation,
+    afterMutation,
+    beforeProcessMutation,
+    afterProcessMutation,
+    settleProcess,
+    onDefaultBackendError: async ({ error }) => {
+      if (!isProviderSandboxGoneDuringRoutedOperation(ids.homeLease.backend, error)) return null;
+      const marked = await markWarmLeaseInstanceLost(db, {
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        sandboxGroupId: ids.homeLease.sandboxGroupId,
+        expectedEpoch: ids.homeLease.leaseEpoch,
+        expectedInstanceId: ids.homeLease.instanceId,
+        diagnostic: "provider_not_found_during_routed_operation"
+      });
+      if (marked.status === "marked" && bus) {
+        await appendAndPublishEvents(db, bus, ids.workspaceId, ids.sessionId, [
+          {
+            type: "sandbox.box.lost",
+            payload: { sandboxId: ids.homeLease.instanceId }
+          }
+        ]).catch(() => void 0);
+      }
+      const lease = marked.lease;
+      const restore = lease?.recovery.restore.status;
+      return {
+        leaseEpoch: lease?.leaseEpoch ?? ids.homeLease.leaseEpoch,
+        recovery: marked.status === "stale" ? "superseded" : restore === "pending" ? "pending" : restore === "degraded" ? "degraded" : "unrecoverable"
+      };
+    }
   });
   return { ...established, session: proxy };
 }
@@ -153,15 +336,33 @@ async function listFleet(services, ctx) {
   };
   const entries = [];
   const groupActive = pointer.activeSandboxId === null;
+  const groupLease = await readLease(db, ctx.workspaceId, ctx.sessionGroupId);
+  const groupOnline = Boolean(
+    groupLease?.liveness === "warm" && groupLease.recovery.provider.status === "exists" && groupLease.recovery.workspace.status === "ready"
+  );
+  const groupRecovering = Boolean(
+    groupLease && (groupLease.liveness === "warming" || groupLease.recovery.restore.status === "pending" || groupLease.recovery.restore.status === "restoring" || groupLease.recovery.restore.status === "verifying")
+  );
   entries.push({
     id: ctx.sessionGroupId,
     kind: ctx.sessionBackend === "selfhosted" ? "selfhosted" : "modal",
     name: "session sandbox",
-    liveness: "online",
+    liveness: groupOnline ? "online" : groupRecovering ? "reconnecting" : "offline",
     active: groupActive,
     isSessionGroup: true,
     enrollmentId: null,
-    attachable: true
+    attachable: groupOnline,
+    providerStatus: groupLease?.recovery.provider.status ?? "not_created",
+    leaseLiveness: groupLease?.liveness ?? null,
+    routeStatus: groupActive ? "attached" : "detached",
+    archiveStatus: groupLease?.recovery.archive.status ?? "none",
+    restoreStatus: groupLease?.recovery.restore.status ?? "not_required",
+    workspaceStatus: groupLease?.recovery.workspace.status ?? "unknown",
+    leaseEpoch: groupLease?.leaseEpoch ?? null,
+    routeEpoch: pointer.activeEpoch,
+    workspaceGeneration: groupLease?.workspaceGeneration ?? null,
+    archiveGeneration: groupLease?.archiveGeneration ?? null,
+    archiveComplete: groupLease?.archiveComplete ?? false
   });
   const sandboxes = await listSandboxes(db, ctx.workspaceId);
   for (const sandbox of sandboxes) {
@@ -181,7 +382,18 @@ async function listFleet(services, ctx) {
       attachable: probe.liveness === "online",
       consented: probe.consented,
       hasDisplay: probe.hasDisplay,
-      lastSeenAt: enrollment?.lastSeenAt ?? null
+      lastSeenAt: enrollment?.lastSeenAt ?? null,
+      providerStatus: probe.liveness === "online" ? "exists" : probe.liveness === "reconnecting" ? "unknown" : "missing",
+      leaseLiveness: null,
+      routeStatus: pointer.activeSandboxId === sandbox.id ? "attached" : "detached",
+      archiveStatus: "none",
+      restoreStatus: "not_required",
+      workspaceStatus: probe.liveness === "online" ? "ready" : "not_ready",
+      leaseEpoch: null,
+      routeEpoch: pointer.activeEpoch,
+      workspaceGeneration: null,
+      archiveGeneration: null,
+      archiveComplete: false
     });
   }
   return {
@@ -239,57 +451,75 @@ async function resolveTarget(services, ctx, target) {
 async function swapActiveSandbox(services, ctx, target, workingDir) {
   const resolved = await resolveTarget(services, ctx, target);
   if (!resolved.ok) {
-    const pointer2 = await readActiveSandbox2(services.db, ctx.workspaceId, ctx.sessionId) ?? {
+    const pointer = await readActiveSandbox2(services.db, ctx.workspaceId, ctx.sessionId) ?? {
       activeSandboxId: null,
       activeEpoch: 0
     };
     return {
       swapped: false,
-      activeSandboxId: pointer2.activeSandboxId,
-      activeEpoch: pointer2.activeEpoch,
+      activeSandboxId: pointer.activeSandboxId,
+      activeEpoch: pointer.activeEpoch,
       reason: resolved.reason,
       code: resolved.code
     };
   }
-  for (let attempt = 0; attempt < 2; attempt += 1) {
-    const pointer2 = await readActiveSandbox2(services.db, ctx.workspaceId, ctx.sessionId) ?? {
-      activeSandboxId: null,
-      activeEpoch: 0
-    };
-    if (pointer2.activeSandboxId === resolved.targetSandboxId) {
+  let readinessHold;
+  if (resolved.targetSandboxId === null && services.ensureSessionGroupReady) {
+    try {
+      readinessHold = await services.ensureSessionGroupReady(ctx);
+    } catch (error) {
+      const lease = await readLease(services.db, ctx.workspaceId, ctx.sessionGroupId);
+      const restore = lease?.recovery.restore.status;
+      const code = restore === "degraded" ? "recovery_degraded" : restore === "unrecoverable" ? "recovery_unrecoverable" : "recovery_in_progress";
+      const pointer = await readActiveSandbox2(services.db, ctx.workspaceId, ctx.sessionId) ?? {
+        activeSandboxId: null,
+        activeEpoch: 0
+      };
       return {
-        swapped: true,
-        activeSandboxId: pointer2.activeSandboxId,
-        activeEpoch: pointer2.activeEpoch
+        swapped: false,
+        activeSandboxId: pointer.activeSandboxId,
+        activeEpoch: pointer.activeEpoch,
+        reason: error instanceof Error ? error.message : "session sandbox did not reach verified readiness",
+        code
       };
     }
-    const result = await setActiveSandbox(services.db, {
-      accountId: ctx.accountId,
-      workspaceId: ctx.workspaceId,
-      sessionId: ctx.sessionId,
-      targetSandboxId: resolved.targetSandboxId,
-      expectedEpoch: pointer2.activeEpoch,
-      ...workingDir !== void 0 ? { workingDir } : {}
-    });
-    if (result.swapped && result.pointer) {
-      return {
-        swapped: true,
-        activeSandboxId: result.pointer.activeSandboxId,
-        activeEpoch: result.pointer.activeEpoch
+  }
+  try {
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const pointer2 = await readActiveSandbox2(services.db, ctx.workspaceId, ctx.sessionId) ?? {
+        activeSandboxId: null,
+        activeEpoch: 0
       };
+      const result = await setActiveSandbox(services.db, {
+        accountId: ctx.accountId,
+        workspaceId: ctx.workspaceId,
+        sessionId: ctx.sessionId,
+        targetSandboxId: resolved.targetSandboxId,
+        expectedEpoch: pointer2.activeEpoch,
+        ...workingDir !== void 0 ? { workingDir } : {}
+      });
+      if (result.swapped && result.pointer) {
+        return {
+          swapped: true,
+          activeSandboxId: result.pointer.activeSandboxId,
+          activeEpoch: result.pointer.activeEpoch
+        };
+      }
     }
+    const pointer = await readActiveSandbox2(services.db, ctx.workspaceId, ctx.sessionId) ?? {
+      activeSandboxId: null,
+      activeEpoch: 0
+    };
+    return {
+      swapped: false,
+      activeSandboxId: pointer.activeSandboxId,
+      activeEpoch: pointer.activeEpoch,
+      reason: "a concurrent swap won the epoch fence; re-read and retry",
+      code: "concurrent_swap"
+    };
+  } finally {
+    await readinessHold?.release().catch(() => void 0);
   }
-  const pointer = await readActiveSandbox2(services.db, ctx.workspaceId, ctx.sessionId) ?? {
-    activeSandboxId: null,
-    activeEpoch: 0
-  };
-  return {
-    swapped: false,
-    activeSandboxId: pointer.activeSandboxId,
-    activeEpoch: pointer.activeEpoch,
-    reason: "a concurrent swap won the epoch fence; re-read and retry",
-    code: "concurrent_swap"
-  };
 }
 async function runOnSandbox(services, ctx, target, op) {
   const sandbox = await getSandbox2(services.db, ctx.workspaceId, target);
@@ -2698,6 +2928,22 @@ function enabledCapabilityMcpToolRefs(settings, runtimeSettings) {
 function withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings) {
   return mergeToolRefs(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));
 }
+function availableToolRefs(tools, settings) {
+  const available = new Set(settings.mcpServers.map((server) => server.id));
+  return tools.filter((tool) => available.has(tool.id));
+}
+function assertToolRefsSubset(requested, allowed, message = "requested tools exceed the session tool policy") {
+  const allowedIds = new Set(allowed.map((tool) => `${tool.kind}:${tool.id}`));
+  const widened = requested.find((tool) => !allowedIds.has(`${tool.kind}:${tool.id}`));
+  if (widened) {
+    throw new HTTPException8(403, { message: `${message}: ${widened.id}` });
+  }
+}
+function validateToolRefsForSessionPolicy(input) {
+  const validated = validateToolRefs(input.requested, input.settings);
+  assertToolRefsSubset(validated, input.allowedTools, input.message);
+  return validated;
+}
 function normalizeResources(resources) {
   const mountPaths = /* @__PURE__ */ new Map();
   const identities = /* @__PURE__ */ new Map();
@@ -2902,29 +3148,161 @@ function positiveInteger(value) {
   return null;
 }
 
+// src/domain/session-tool-policy.ts
+import {
+  SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
+  SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH,
+  mergeToolRefs as mergeToolRefs2
+} from "@opengeni/contracts";
+var MANDATORY_SESSION_MCP_SERVER_IDS = ["opengeni"];
+var PROJECTABLE_REGISTRY_ID = /^[A-Za-z0-9_-]+$/;
+function sortedIds(ids) {
+  return [...new Set(ids)].sort();
+}
+function projectIds(ids) {
+  const projectable = ids.filter(
+    (id) => id.length <= SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH && PROJECTABLE_REGISTRY_ID.test(id)
+  );
+  return {
+    ids: projectable.slice(0, SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT),
+    truncated: projectable.length !== ids.length || projectable.length > SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT
+  };
+}
+function resolveSessionToolPolicy(input) {
+  const policy = input.toolPolicy ?? { mode: "legacy", inheritedFromSessionId: null };
+  const availableIds = new Set(input.availableMcpServerIds);
+  const defaultIds = new Set(input.defaultMcpServerIds ?? []);
+  const mandatoryIds = MANDATORY_SESSION_MCP_SERVER_IDS.filter(
+    (id) => availableIds.has(id)
+  );
+  const mandatoryIdSet = new Set(mandatoryIds);
+  const selectedRefs = input.turnToolsProvided === true ? mergeToolRefs2([], input.turnTools ?? []) : input.turnToolsProvided === false ? mergeToolRefs2([], input.sessionTools) : mergeToolRefs2(input.sessionTools, input.turnTools ?? []);
+  const tracksWorkspaceDefaults = policy.mode === "workspace_default" && input.turnToolsProvided !== true;
+  let toolRefs = selectedRefs.filter((tool) => tool.optional !== true || availableIds.has(tool.id));
+  if (tracksWorkspaceDefaults) {
+    toolRefs = mergeToolRefs2(
+      toolRefs,
+      sortedIds(defaultIds).filter((id) => availableIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true }))
+    );
+  }
+  toolRefs = mergeToolRefs2(
+    toolRefs,
+    mandatoryIds.map((id) => ({ kind: "mcp", id }))
+  );
+  const requestedEffectiveRefs = mergeToolRefs2(
+    selectedRefs,
+    tracksWorkspaceDefaults ? sortedIds(defaultIds).filter((id) => availableIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true })) : []
+  );
+  const effectiveIds = sortedIds(
+    mergeToolRefs2(
+      requestedEffectiveRefs,
+      mandatoryIds.map((id) => ({ kind: "mcp", id }))
+    ).map((tool) => tool.id)
+  );
+  const configuredIds = effectiveIds.filter((id) => availableIds.has(id));
+  const configuredIdSet = new Set(configuredIds);
+  const droppedIds = effectiveIds.filter((id) => !configuredIdSet.has(id));
+  const deferredIds = tracksWorkspaceDefaults ? sortedIds(
+    toolRefs.filter(
+      (tool) => tool.optional === true && configuredIdSet.has(tool.id) && !mandatoryIdSet.has(tool.id)
+    ).map((tool) => tool.id)
+  ) : [];
+  const selectedIds = sortedIds(
+    selectedRefs.filter(
+      (tool) => !mandatoryIdSet.has(tool.id) && !(tracksWorkspaceDefaults && tool.optional === true)
+    ).map((tool) => tool.id)
+  );
+  const projections = {
+    selected: projectIds(selectedIds),
+    effective: projectIds(effectiveIds),
+    mandatory: projectIds(sortedIds(mandatoryIds)),
+    deferred: projectIds(deferredIds),
+    configured: projectIds(configuredIds),
+    dropped: projectIds(droppedIds)
+  };
+  return {
+    toolRefs,
+    effectivePolicy: {
+      mode: policy.mode,
+      inheritedFromSessionId: policy.inheritedFromSessionId,
+      selectedIds: projections.selected.ids,
+      effectiveIds: projections.effective.ids,
+      mandatoryIds: projections.mandatory.ids,
+      lazyRouter: {
+        state: tracksWorkspaceDefaults ? "required" : "disabled",
+        deferredIds: projections.deferred.ids
+      },
+      configuredIds: projections.configured.ids,
+      droppedIds: projections.dropped.ids,
+      counts: {
+        selected: selectedIds.length,
+        effective: effectiveIds.length,
+        mandatory: mandatoryIds.length,
+        deferred: deferredIds.length,
+        configured: configuredIds.length,
+        dropped: droppedIds.length
+      },
+      idsTruncated: Object.values(projections).some((projection) => projection.truncated)
+    }
+  };
+}
+async function workspaceSessionToolPolicyServerIds(db, workspaceId, settings) {
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
+  return sortedIds(runtimeSettings.mcpServers.map((server) => server.id));
+}
+async function workspaceSessionToolPolicyDefaultServerIds(db, workspaceId, settings) {
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
+  return sortedIds(enabledCapabilityMcpToolRefs(settings, runtimeSettings).map((tool) => tool.id));
+}
+function sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDefaultServerIds = []) {
+  const availableIds = new Set(workspaceServerIds);
+  for (const server of session.mcpServers) {
+    availableIds.add(server.id);
+  }
+  return {
+    ...session,
+    effectiveToolPolicy: resolveSessionToolPolicy({
+      ...session.toolPolicy ? { toolPolicy: session.toolPolicy } : {},
+      sessionTools: session.tools,
+      availableMcpServerIds: availableIds,
+      defaultMcpServerIds: workspaceDefaultServerIds
+    }).effectivePolicy
+  };
+}
+
 // src/domain/scheduled-tasks.ts
 import {
   createScheduledTask,
   deleteScheduledTask,
+  getNestedAgentDepthDeploymentPolicy,
   getRig as getRig3,
   getScheduledTask,
+  requireWorkspace as requireWorkspace2,
   updateScheduledTask
 } from "@opengeni/db";
 import { HTTPException as HTTPException10 } from "hono/http-exception";
 
 // src/domain/sessions.ts
 import { CODEX_MODEL_ID_PREFIX } from "@opengeni/codex";
-import { configuredAllowedModels, policyProviderIdForModel } from "@opengeni/config";
+import {
+  canonicalizeConfiguredModelId,
+  configuredAllowedModels,
+  policyProviderIdForModel,
+  resolveTurnExecutionPolicyV1
+} from "@opengeni/config";
 import {
   CreateSessionRequest,
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  SessionSpawnDenial,
   ServiceTurnInitiator,
   ServiceTurnInitiatorContext,
   evaluateWorkspaceModelPolicy,
-  reasoningEffortForMetadata
+  reasoningEffortForMetadata,
+  SessionMcpApprovalPolicy
 } from "@opengeni/contracts";
 import {
   createSession,
-  createSessionWithIdempotencyKey,
+  createSessionWithIdempotencyKeyResult,
   encryptVariableSetValue as encryptVariableSetValue2,
   getAnySessionInGroup,
   getEnrollment as getEnrollment2,
@@ -2935,7 +3313,7 @@ import {
   getSandbox as getSandbox3,
   getSession as getSession2,
   SessionIdConflictError,
-  getSessionByCreateIdempotencyKey,
+  getSessionSpawnDenialByIdempotencyKey,
   getSessionEvent,
   getWorkspaceControlEvent,
   getSessionLineage,
@@ -2946,14 +3324,16 @@ import {
   listSessionMcpServersForChildInheritance,
   requireSession as requireSession2,
   submitHumanPromptInTransaction,
+  appendSessionEventsWithLockedSessionUpdate,
   updateSessionTitle as updateSessionTitleRow,
   withWorkspaceSubjectRls,
   QueueCommandConflictError,
   AgentCommandAuthorityError,
+  SessionSpawnDeniedDbError,
   SessionControlConflictError
 } from "@opengeni/db";
 import {
-  appendAndPublishEvents,
+  appendAndPublishEvents as appendAndPublishEvents2,
   publishDurableSessionEvents,
   publishDurableWorkspaceControlEvent
 } from "@opengeni/events";
@@ -2962,6 +3342,29 @@ var reservedSessionMcpServerIds = /* @__PURE__ */ new Set(["opengeni", "files",
 var maxSessionMcpCredentialHeaders = 16;
 var maxSessionMcpCredentialHeaderValueLength = 4096;
 var sessionMcpCredentialHeaderName = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+var SessionSpawnDeniedError = class extends Error {
+  denial;
+  constructor(denial) {
+    super(sessionSpawnDeniedMessage(denial));
+    this.name = "SessionSpawnDeniedError";
+    this.denial = denial;
+  }
+};
+function sessionSpawnDeniedMessage(denial) {
+  if (denial.code === "nested_agent_depth_override_forbidden") {
+    return `requested nested-agent depth limit ${denial.requestedMaxNestedAgentDepthOverride ?? "unknown"} exceeds inherited limit ${denial.effectiveMaxNestedAgentDepth}; workspace:admin is required to increase it`;
+  }
+  return `nested-agent depth ${denial.attemptedDepth} exceeds effective limit ${denial.effectiveMaxNestedAgentDepth} (current parent depth ${denial.currentDepth})`;
+}
+function sessionSpawnDenialEnvelope(error) {
+  return {
+    error: {
+      code: error.denial.code,
+      message: error.message,
+      details: { denial: error.denial }
+    }
+  };
+}
 function serviceInitiatorForGrant(grant) {
   if (!grant.serviceInitiator) {
     if (grant.serviceInitiatorContext) {
@@ -3091,6 +3494,7 @@ function mcpServerConfigFromMetadata(server) {
     ...server.name ? { name: server.name } : {},
     url: server.url,
     cacheToolsList: false,
+    requireApproval: server.requireApproval,
     ...server.connectionRef ? { connectionRef: server.connectionRef } : {}
   };
 }
@@ -3151,6 +3555,7 @@ function validateSessionMcpServersForCreate(settings, grant, servers) {
       url: server.url,
       headerNames: Object.keys(headersEncrypted).sort(),
       credentialVersion: 1,
+      requireApproval: server.requireApproval ?? false,
       connectionRef: server.connectionRef ?? null
     });
   }
@@ -3186,6 +3591,7 @@ function validateInheritedSessionMcpServersForCreate(servers) {
       url: server.url,
       headerNames: Object.keys(server.headersEncrypted ?? {}).sort(),
       credentialVersion: 1,
+      requireApproval: server.requireApproval ?? false,
       connectionRef: server.connectionRef ?? null
     }))
   };
@@ -3228,21 +3634,7 @@ async function createAndStartSession(input) {
     reasoningEffort: input.reasoningEffort
   };
   if (input.createIdempotencyKey) {
-    const existing = await getSessionByCreateIdempotencyKey(
-      input.db,
-      input.workspaceId,
-      input.createIdempotencyKey
-    );
-    if (existing) {
-      if (input.requestedSessionId && existing.id !== input.requestedSessionId) {
-        throw new SessionIdConflictError(input.requestedSessionId);
-      }
-      return await finishStartSession(
-        existing.temporalWorkflowId ? { ...input, seedTargetSandbox: null } : input,
-        existing
-      );
-    }
-    const { session: keyed, created } = await createSessionWithIdempotencyKey(input.db, {
+    const keyedResult = await createSessionWithIdempotencyKeyResult(input.db, {
       ...input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {},
       accountId: input.accountId,
       workspaceId: input.workspaceId,
@@ -3250,6 +3642,7 @@ async function createAndStartSession(input) {
       initialTurnInstructions: input.turnInstructions ?? null,
       resources: input.resources,
       tools: input.tools,
+      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
       metadata: sessionMetadata,
       ...input.createdBy ? { createdBy: input.createdBy } : {},
       ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
@@ -3265,8 +3658,15 @@ async function createAndStartSession(input) {
       createIdempotencyKey: input.createIdempotencyKey,
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
-      mcpServers: input.mcpServers ?? []
+      mcpServers: input.mcpServers ?? [],
+      maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
+      allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
+      subjectId: input.subjectId ?? null
     });
+    if (keyedResult.denied) {
+      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(keyedResult.denial));
+    }
+    const { session: keyed, created } = keyedResult;
     if (!created) {
       return await finishStartSession(
         keyed.temporalWorkflowId ? { ...input, seedTargetSandbox: null } : input,
@@ -3275,30 +3675,42 @@ async function createAndStartSession(input) {
     }
     return await finishStartSession(input, keyed);
   }
-  const session = await createSession(input.db, {
-    ...input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {},
-    accountId: input.accountId,
-    workspaceId: input.workspaceId,
-    initialMessage: input.initialMessage,
-    initialTurnInstructions: input.turnInstructions ?? null,
-    resources: input.resources,
-    tools: input.tools,
-    metadata: sessionMetadata,
-    ...input.createdBy ? { createdBy: input.createdBy } : {},
-    ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
-    createdByActor: input.createdByActor ?? null,
-    model: input.model,
-    sandboxBackend: input.sandboxBackend,
-    variableSetId: input.variableSet?.id ?? null,
-    rigId: input.rigId ?? null,
-    rigVersionId: input.rigVersionId ?? null,
-    firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
-    instructions: input.instructions ?? null,
-    parentSessionId: input.parentSessionId ?? null,
-    sandboxGroupId: input.sandboxGroupId ?? null,
-    ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
-    mcpServers: input.mcpServers ?? []
-  });
+  let session;
+  try {
+    session = await createSession(input.db, {
+      ...input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {},
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      initialMessage: input.initialMessage,
+      initialTurnInstructions: input.turnInstructions ?? null,
+      resources: input.resources,
+      tools: input.tools,
+      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
+      metadata: sessionMetadata,
+      ...input.createdBy ? { createdBy: input.createdBy } : {},
+      ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
+      createdByActor: input.createdByActor ?? null,
+      model: input.model,
+      sandboxBackend: input.sandboxBackend,
+      variableSetId: input.variableSet?.id ?? null,
+      rigId: input.rigId ?? null,
+      rigVersionId: input.rigVersionId ?? null,
+      firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+      instructions: input.instructions ?? null,
+      parentSessionId: input.parentSessionId ?? null,
+      sandboxGroupId: input.sandboxGroupId ?? null,
+      ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
+      mcpServers: input.mcpServers ?? [],
+      maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
+      allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
+      subjectId: input.subjectId ?? null
+    });
+  } catch (error) {
+    if (error instanceof SessionSpawnDeniedDbError) {
+      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(error.denial));
+    }
+    throw error;
+  }
   return await finishStartSession(input, session);
 }
 async function finishStartSession(input, session) {
@@ -3335,7 +3747,9 @@ async function finishStartSession(input, session) {
     sessionId: session.id,
     ...input.clientEventId ? { clientEventId: input.clientEventId } : {},
     reasoningEffortFallback: input.reasoningEffort,
+    turnExecutionPolicy: input.turnExecutionPolicy,
     createdEventPayload: {
+      ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
       ...input.variableSet ? { variableSetId: input.variableSet.id, variableSetName: input.variableSet.name } : {},
       ...input.sessionMcpServers?.length ? { mcpServers: input.sessionMcpServers } : {}
     },
@@ -3343,7 +3757,8 @@ async function finishStartSession(input, session) {
       text: input.goal.text,
       ...input.goal.successCriteria !== void 0 ? { successCriteria: input.goal.successCriteria } : {},
       ...input.goal.maxAutoContinuations !== void 0 ? { maxAutoContinuations: input.goal.maxAutoContinuations } : {}
-    } : null
+    } : null,
+    consumeNewSessionDraft: input.consumeNewSessionDraft ?? null
   });
   await publishDurableSessionEvents(input.bus, session.workspaceId, session.id, started.events);
   if (started.workflowWakeRevision !== null) {
@@ -3362,31 +3777,42 @@ async function finishStartSession(input, session) {
 function workflowIdForSession(sessionId) {
   return `session-${sessionId}`;
 }
-function assertConfiguredModel(settings, model) {
+function canonicalConfiguredModel(settings, model) {
   if (model === null || model === void 0) {
-    return;
+    return model;
   }
-  if (configuredAllowedModels(settings).includes(model)) {
-    return;
+  const canonicalModel = canonicalizeConfiguredModelId(settings, model);
+  if (configuredAllowedModels(settings).includes(canonicalModel)) {
+    return canonicalModel;
   }
-  if (settings.codexSubscriptionEnabled && model.startsWith(CODEX_MODEL_ID_PREFIX)) {
-    return;
+  if (settings.codexSubscriptionEnabled && canonicalModel.startsWith(CODEX_MODEL_ID_PREFIX)) {
+    return canonicalModel;
   }
   throw new HTTPException9(422, { message: `model is not available: ${model}` });
 }
+function assertConfiguredModel(settings, model) {
+  canonicalConfiguredModel(settings, model);
+}
 async function assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model) {
   if (model === null || model === void 0) {
     return;
   }
+  const canonicalModel = canonicalConfiguredModel(settings, model);
+  if (canonicalModel === null || canonicalModel === void 0) {
+    return;
+  }
   const policy = await getWorkspaceModelPolicy(db, workspaceId);
   if (!policy) {
     return;
   }
-  const providerId = policyProviderIdForModel(settings, model);
-  const verdict = evaluateWorkspaceModelPolicy(policy, { providerId, modelId: model });
+  const providerId = policyProviderIdForModel(settings, canonicalModel);
+  const verdict = evaluateWorkspaceModelPolicy(policy, {
+    providerId,
+    modelId: canonicalModel
+  });
   if (!verdict.allowed) {
     throw new HTTPException9(422, {
-      message: verdict.reason === "provider" ? `model "${model}" is not allowed by this workspace's model policy: provider "${providerId}" is not in the allowed providers` : `model "${model}" is not allowed by this workspace's model policy`
+      message: verdict.reason === "provider" ? `model "${canonicalModel}" is not allowed by this workspace's model policy: provider "${providerId}" is not in the allowed providers` : `model "${canonicalModel}" is not allowed by this workspace's model policy`
     });
   }
 }
@@ -3407,7 +3833,7 @@ function reasoningEffortForSession(metadata, fallback) {
 }
 async function postUserMessageTurn(input) {
   const { db, bus, workflowClient, settings, accountId, workspaceId, sessionId } = input;
-  const requestedModel = input.model ?? null;
+  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
   const requestedReasoningEffort = input.reasoningEffort ?? null;
   assertConfiguredModel(settings, requestedModel);
   await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, requestedModel);
@@ -3437,9 +3863,11 @@ async function postUserMessageTurn(input) {
           turnInstructions: input.turnInstructions ?? null,
           resources: input.resources,
           tools: input.tools,
+          toolsProvided: input.toolsProvided,
           model: requestedModel,
           reasoningEffort: requestedReasoningEffort,
-          reasoningEffortFallback: settings.openaiReasoningEffort,
+          reasoningEffortFallback: input.reasoningEffortFallback ?? settings.openaiReasoningEffort,
+          turnExecutionPolicy: input.turnExecutionPolicy,
           source: input.origin === "operator" ? "api" : "user",
           mcpCredentialUpdates: input.mcpCredentialUpdates ?? []
         })
@@ -3506,6 +3934,16 @@ async function postUserMessageTurn(input) {
 async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   const payload = CreateSessionRequest.parse(rawPayload);
+  if (payload.idempotencyKey) {
+    const denial = await getSessionSpawnDenialByIdempotencyKey(
+      db,
+      workspaceId,
+      payload.idempotencyKey
+    );
+    if (denial) {
+      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(denial));
+    }
+  }
   const parentSessionId = typeof grant.metadata?.["sessionId"] === "string" ? grant.metadata["sessionId"] : null;
   if (parentSessionId) {
     await requireSessionAuthorization(deps, grant, {
@@ -3535,12 +3973,50 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   const resources = normalizeResources(
     hasOwnProperty(rawPayload, "resources") ? payload.resources : parentSession?.resources ?? payload.resources
   );
+  const toolsProvided = hasOwnProperty(rawPayload, "tools");
   const requestedTools = validateToolRefs(
-    hasOwnProperty(rawPayload, "tools") ? payload.tools : parentSession?.tools ?? payload.tools,
+    toolsProvided ? payload.tools : parentSession?.tools ?? payload.tools,
     runtimeSettings
   );
-  const defaultedTools = hasOwnProperty(rawPayload, "tools") || parentSession ? requestedTools : withDefaultEnabledCapabilityMcpTools(requestedTools, settings, capabilityRuntimeSettings);
-  const tools = withFirstPartyTools(defaultedTools, runtimeSettings);
+  let selectedTools;
+  let toolPolicy;
+  if (parentSession) {
+    const parentTracksWorkspaceDefaults = parentSession.toolPolicy?.mode === "workspace_default";
+    const parentEffective = withFirstPartyTools(
+      parentTracksWorkspaceDefaults ? withDefaultEnabledCapabilityMcpTools(
+        availableToolRefs(parentSession.tools, runtimeSettings),
+        settings,
+        runtimeSettings
+      ) : parentSession.tools,
+      runtimeSettings
+    );
+    if (toolsProvided) {
+      assertToolRefsSubset(
+        requestedTools,
+        parentEffective,
+        "child tools may only narrow the parent session tool policy"
+      );
+      selectedTools = requestedTools;
+      toolPolicy = { mode: "explicit", inheritedFromSessionId: parentSession.id };
+    } else {
+      selectedTools = parentEffective;
+      toolPolicy = {
+        mode: parentTracksWorkspaceDefaults ? "workspace_default" : "inherited",
+        inheritedFromSessionId: parentSession.id
+      };
+    }
+  } else if (toolsProvided) {
+    selectedTools = requestedTools;
+    toolPolicy = { mode: "explicit", inheritedFromSessionId: null };
+  } else {
+    selectedTools = withDefaultEnabledCapabilityMcpTools(
+      requestedTools,
+      settings,
+      capabilityRuntimeSettings
+    );
+    toolPolicy = { mode: "workspace_default", inheritedFromSessionId: null };
+  }
+  const tools = withFirstPartyTools(selectedTools, runtimeSettings);
   await validateGitHubRepositorySelection(db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
     throw new HTTPException9(503, { message: "object storage is not configured" });
@@ -3568,16 +4044,30 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       frozenRigVersionId = rig.activeVersion.id;
     }
   }
-  assertConfiguredModel(settings, payload.model);
-  await assertWorkspaceModelPolicyAllows(
-    db,
-    settings,
-    workspaceId,
-    payload.model ?? settings.openaiModel
-  );
-  const model = payload.model ?? settings.openaiModel;
+  const model = canonicalConfiguredModel(settings, payload.model ?? settings.openaiModel);
+  if (model === null || model === void 0) {
+    throw new Error("effective session model unexpectedly resolved to null");
+  }
+  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
   const reasoningEffort = payload.reasoningEffort ?? settings.openaiReasoningEffort;
-  let firstPartyMcpPermissions = payload.firstPartyMcpPermissions ?? (parentSessionId ? [...new Set(grant.permissions)] : null);
+  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
+    modelId: model,
+    requestedModelId: payload.model ?? null,
+    modelSource: payload.model === void 0 ? "deployment" : "explicit",
+    reasoningEffort,
+    reasoningSource: payload.reasoningEffort === void 0 ? "deployment" : "explicit"
+  });
+  const parentFirstPartyMcpPermissions = parentSession ? [...parentSession.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS] : null;
+  if (parentFirstPartyMcpPermissions && payload.firstPartyMcpPermissions?.some(
+    (permission) => !hasPermission(parentFirstPartyMcpPermissions, permission)
+  )) {
+    throw new HTTPException9(403, {
+      message: "child first-party MCP permissions may only narrow the parent session grant"
+    });
+  }
+  let firstPartyMcpPermissions = payload.firstPartyMcpPermissions ?? (parentFirstPartyMcpPermissions ? parentFirstPartyMcpPermissions.filter(
+    (permission) => hasPermission(grant.permissions, permission)
+  ) : null);
   if (firstPartyMcpPermissions && firstPartyMcpPermissions.length === 0) {
     throw new HTTPException9(422, {
       message: "firstPartyMcpPermissions must not be empty; omit it for the default worker permission set"
@@ -3710,9 +4200,11 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       turnInstructions: payload.turnInstructions ?? null,
       resources,
       tools,
+      toolPolicy,
       ...payload.clientEventId ? { clientEventId: payload.clientEventId } : {},
       model,
       reasoningEffort,
+      turnExecutionPolicy,
       // A shared spawn inherits the box's backend; a caller-supplied
       // sandboxBackend on a shared spawn is ignored (it is the same box). A
       // machine-targeted top-level create labels the home "selfhosted"
@@ -3742,11 +4234,18 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       sessionMcpServers: sessionMcpServers.metadata,
       parentSessionId,
       createIdempotencyKey: payload.idempotencyKey ?? null,
+      maxNestedAgentDepthOverride: payload.maxNestedAgentDepth ?? null,
+      allowNestedAgentDepthIncrease: hasPermission(grant.permissions, "workspace:admin"),
+      subjectId: grant.subjectId,
       // Create-time machine targeting (A-2a): when a target sandbox is named, the
       // active-sandbox pointer is seeded race-free inside createAndStartSession
       // (after the row exists, before the first turn dispatches). Validation
       // (ownership/liveness) lives in swapActiveSandbox; an invalid target 422s.
-      seedTargetSandbox: payload.targetSandboxId ? { sandboxId: payload.targetSandboxId, settings, workingDir: payload.workingDir ?? null } : null
+      seedTargetSandbox: payload.targetSandboxId ? { sandboxId: payload.targetSandboxId, settings, workingDir: payload.workingDir ?? null } : null,
+      consumeNewSessionDraft: payload.expectedNewSessionDraftRevision !== void 0 ? {
+        subjectId: grant.subjectId,
+        expectedRevision: payload.expectedNewSessionDraftRevision
+      } : null
     });
   } catch (error) {
     if (error instanceof AgentCommandAuthorityError) {
@@ -3777,6 +4276,11 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   return session;
 }
 async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, input) {
+  if (input.toolsProvided && !deps.settings.sessionTurnToolReplacementEnabled) {
+    throw new HTTPException9(503, {
+      message: "explicit follow-up tool replacement is temporarily unavailable until provenance-aware turn workers finish rolling out; omit tools to inherit the session policy and retry"
+    });
+  }
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   await requireSessionAuthorization(deps, grant, {
     sessionId,
@@ -3789,19 +4293,50 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     settings
   );
   const existingSession = await requireSession2(db, workspaceId, sessionId);
+  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
+  const effectiveModel = canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;
+  if (effectiveModel === null) {
+    throw new Error("effective follow-up model unexpectedly resolved to null");
+  }
+  const sessionReasoningEffort = reasoningEffortForSession(
+    existingSession.metadata,
+    settings.openaiReasoningEffort
+  );
+  const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;
+  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
+    modelId: effectiveModel,
+    requestedModelId: input.model ?? null,
+    modelSource: input.model == null ? "session" : "explicit",
+    reasoningEffort: effectiveReasoningEffort,
+    reasoningSource: input.reasoningEffort == null ? "session" : "explicit"
+  });
   const runtimeSettings = settingsWithSessionMcpServerMetadata(
     capabilityRuntimeSettings,
     existingSession.mcpServers
   );
   const requestedResources = normalizeResources(input.resources ?? []);
-  const validatedTools = validateToolRefs(input.tools ?? [], runtimeSettings);
-  const requestedTools = input.toolsProvided ? validatedTools : withDefaultEnabledCapabilityMcpTools(validatedTools, settings, capabilityRuntimeSettings);
+  const tracksWorkspaceDefaults = existingSession.toolPolicy?.mode === "workspace_default";
+  const sessionPolicyTools = withFirstPartyTools(
+    tracksWorkspaceDefaults ? withDefaultEnabledCapabilityMcpTools(
+      availableToolRefs(existingSession.tools, runtimeSettings),
+      settings,
+      capabilityRuntimeSettings
+    ) : existingSession.tools,
+    runtimeSettings
+  );
+  const validatedTools = input.toolsProvided ? validateToolRefsForSessionPolicy({
+    requested: input.tools ?? [],
+    settings: runtimeSettings,
+    allowedTools: sessionPolicyTools,
+    message: "message tools may only narrow the session tool policy"
+  }) : [];
+  const requestedTools = input.toolsProvided ? validatedTools : [];
   await requireLimit(deps, {
     accountId: grant.accountId,
     workspaceId,
     action: "agent_run:create",
     quantity: 1,
-    model: input.model ?? existingSession.model
+    model: effectiveModel
   });
   if (requestedResources.some((resource) => resource.kind === "file") && !objectStorage) {
     throw new HTTPException9(503, { message: "object storage is not configured" });
@@ -3830,8 +4365,11 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     turnInstructions: input.turnInstructions ?? null,
     resources: requestedResources,
     tools: requestedTools,
+    toolsProvided: input.toolsProvided,
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
+    reasoningEffortFallback: sessionReasoningEffort,
+    turnExecutionPolicy,
     mcpCredentialUpdates,
     delivery: input.delivery ?? "send",
     origin: delegatedServiceInitiator ? "operator" : input.origin ?? "human",
@@ -3877,7 +4415,7 @@ async function updateSessionTitle(deps, grant, sessionId, title, source) {
   const workspaceId = grant.workspaceId;
   const result = await updateSessionTitleRow(db, { workspaceId, sessionId, title, source });
   if (result.updated) {
-    await appendAndPublishEvents(db, bus, workspaceId, sessionId, [
+    await appendAndPublishEvents2(db, bus, workspaceId, sessionId, [
       {
         type: "session.title_set",
         payload: {
@@ -3892,6 +4430,48 @@ async function updateSessionTitle(deps, grant, sessionId, title, source) {
     relatedSessionAccess: authorization?.relatedSessionAccess ?? "root"
   };
 }
+async function updateSessionMcpApprovalPolicy(deps, grant, sessionId, serverId, requireApproval) {
+  const normalizedPolicy = SessionMcpApprovalPolicy.parse(requireApproval);
+  await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.mcp.approval_policy.write",
+    surface: "core"
+  });
+  requirePermission(grant, "sessions:control");
+  const outcome = {};
+  const events = await appendSessionEventsWithLockedSessionUpdate(
+    deps.db,
+    grant.workspaceId,
+    sessionId,
+    async (_session, context) => {
+      const result = await context.updateSessionMcpApprovalPolicy(serverId, normalizedPolicy);
+      if (!result.server) {
+        throw new HTTPException9(404, { message: "session MCP server not found" });
+      }
+      outcome.server = result.server;
+      return {
+        events: result.changed ? [
+          {
+            type: "session.mcp.approval_policy.updated",
+            payload: {
+              serverId,
+              effectiveFrom: "next_attempt"
+            }
+          }
+        ] : []
+      };
+    }
+  );
+  const updatedServer = outcome.server;
+  if (!updatedServer) {
+    throw new Error("session MCP approval policy update returned no server");
+  }
+  await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, events);
+  return {
+    server: updatedServer,
+    effectiveFrom: "next_attempt"
+  };
+}
 async function readSessionLineage(deps, grant, sessionId) {
   const authorization = await requireSessionAuthorization(deps, grant, {
     sessionId,
@@ -4032,6 +4612,7 @@ async function validatedScheduledTaskUpdate(input) {
       settings: input.settings,
       db: input.db,
       objectStorage: input.objectStorage,
+      grant: input.grant,
       workspaceId: input.existing.workspaceId,
       payload: { agentConfig: input.payload.agentConfig },
       ...input.toolsProvided !== void 0 ? { toolsProvided: input.toolsProvided } : {}
@@ -4095,13 +4676,8 @@ function manualScheduledTaskTriggerUsageKey(workspaceId, taskId, triggerToken) {
   return `agent_run.created:scheduled-trigger:${workspaceId}:${taskId}:${triggerToken}`;
 }
 async function validateScheduledTaskAgentConfig(input) {
-  assertConfiguredModel(input.settings, input.payload.agentConfig.model);
-  await assertWorkspaceModelPolicyAllows(
-    input.db,
-    input.settings,
-    input.workspaceId,
-    input.payload.agentConfig.model
-  );
+  const model = canonicalConfiguredModel(input.settings, input.payload.agentConfig.model);
+  await assertWorkspaceModelPolicyAllows(input.db, input.settings, input.workspaceId, model);
   const resources = normalizeResources(input.payload.agentConfig.resources ?? []);
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     input.db,
@@ -4119,8 +4695,21 @@ async function validateScheduledTaskAgentConfig(input) {
     throw new HTTPException10(503, { message: "object storage is not configured" });
   }
   await validateFileResources(input.db, input.workspaceId, resources);
+  const requestedMaxDepth = input.payload.agentConfig.maxNestedAgentDepth;
+  if (requestedMaxDepth !== void 0) {
+    const workspace = await requireWorkspace2(input.db, input.workspaceId);
+    const workspaceMaxDepth = workspace.settings.maxNestedAgentDepth;
+    const deploymentPolicy = await getNestedAgentDepthDeploymentPolicy(input.db);
+    const inheritedMaxDepth = typeof workspaceMaxDepth === "number" ? workspaceMaxDepth : deploymentPolicy.maxNestedAgentDepth;
+    if (requestedMaxDepth > inheritedMaxDepth && !hasPermission(input.grant.permissions, "workspace:admin")) {
+      throw new HTTPException10(403, {
+        message: `scheduled task maxNestedAgentDepth ${requestedMaxDepth} exceeds inherited limit ${inheritedMaxDepth}; workspace:admin is required to increase it`
+      });
+    }
+  }
   return {
     ...input.payload.agentConfig,
+    ...model === void 0 || model === null ? {} : { model },
     prompt,
     resources,
     tools
@@ -4188,6 +4777,102 @@ function assertWorkspaceDeletable(input) {
   }
 }
 
+// src/application/new-session-drafts.ts
+import {
+  NewSessionDraft,
+  SaveNewSessionDraftRequest
+} from "@opengeni/contracts";
+import {
+  getNewSessionDraftInTransaction,
+  NewSessionDraftAccessError,
+  saveNewSessionDraftInTransaction,
+  withWorkspaceSubjectRls as withWorkspaceSubjectRls2
+} from "@opengeni/db";
+import { HTTPException as HTTPException12 } from "hono/http-exception";
+function mapNewSessionDraft(row) {
+  if (!row) return null;
+  return NewSessionDraft.parse({
+    revision: row.revision,
+    text: row.text,
+    resources: row.resources,
+    tools: row.tools,
+    model: row.model,
+    reasoningEffort: row.reasoningEffort,
+    options: row.sessionOptions,
+    updatedAt: row.updatedAt.toISOString()
+  });
+}
+async function getActorNewSessionDraft(deps, grant, workspaceId) {
+  const row = await withWorkspaceSubjectRls2(
+    deps.db,
+    workspaceId,
+    grant.subjectId,
+    (scoped) => getNewSessionDraftInTransaction(scoped, {
+      workspaceId,
+      subjectId: grant.subjectId
+    })
+  );
+  return mapNewSessionDraft(row) ?? {
+    revision: 0,
+    text: "",
+    resources: [],
+    tools: [],
+    model: deps.settings.openaiModel,
+    reasoningEffort: deps.settings.openaiReasoningEffort,
+    options: {},
+    updatedAt: null
+  };
+}
+async function saveActorNewSessionDraft(deps, grant, workspaceId, rawInput) {
+  const input = SaveNewSessionDraftRequest.parse(rawInput);
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+    deps.db,
+    workspaceId,
+    deps.settings
+  );
+  const resources = normalizeResources(input.resources);
+  const tools = validateToolRefs(input.tools, runtimeSettings);
+  await validateGitHubRepositorySelection(deps.db, workspaceId, resources);
+  if (resources.some((resource) => resource.kind === "file") && !deps.objectStorage) {
+    throw new HTTPException12(503, { message: "object storage is not configured" });
+  }
+  await validateFileResources(deps.db, workspaceId, resources);
+  assertConfiguredModel(deps.settings, input.model);
+  await assertWorkspaceModelPolicyAllows(deps.db, deps.settings, workspaceId, input.model);
+  try {
+    const saved = await withWorkspaceSubjectRls2(
+      deps.db,
+      workspaceId,
+      grant.subjectId,
+      (scoped) => scoped.transaction(
+        (tx) => saveNewSessionDraftInTransaction(tx, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          expectedRevision: input.expectedRevision,
+          text: input.text,
+          resources,
+          tools,
+          model: input.model,
+          reasoningEffort: input.reasoningEffort,
+          options: input.options,
+          // Only managed people are removed through removeWorkspaceMember().
+          // API keys and delegated service actors (for example the first-party
+          // worker MCP principal) legitimately have no workspace_memberships
+          // row, so they must not be rejected by the human-removal fence.
+          requireWorkspaceMembership: grant.subjectId.startsWith("user:")
+        })
+      )
+    );
+    return mapNewSessionDraft(saved);
+  } catch (error) {
+    if (error instanceof NewSessionDraftAccessError) {
+      throw new HTTPException12(403, { message: error.message });
+    }
+    throw error;
+  }
+}
+
 // src/application/session-commands.ts
 import { reasoningEffortForMetadata as reasoningEffortForMetadata2 } from "@opengeni/contracts";
 import {
@@ -4209,7 +4894,7 @@ import {
   steerAgentSessionInTransaction,
   steerQueuedTurnInTransaction,
   withWorkspaceRls,
-  withWorkspaceSubjectRls as withWorkspaceSubjectRls2
+  withWorkspaceSubjectRls as withWorkspaceSubjectRls3
 } from "@opengeni/db";
 import {
   publishDurableSessionEvents as publishDurableSessionEvents2,
@@ -4423,6 +5108,7 @@ function composerDraft(row) {
     text: row.text,
     resources: row.resources,
     tools: row.tools,
+    toolsProvided: row.toolsProvided,
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     sourceTurnId: row.sourceTurnId,
@@ -4500,7 +5186,7 @@ async function deleteHumanQueuePrompt(deps, context, turnId, input) {
 }
 async function editHumanQueuePrompt(deps, context, turnId, input) {
   const authorization = await authorizeHumanSessionCommand(deps, context, "session.queue.control");
-  const result = await withWorkspaceSubjectRls2(
+  const result = await withWorkspaceSubjectRls3(
     deps.db,
     context.workspaceId,
     context.subjectId,
@@ -4622,7 +5308,7 @@ async function controlHumanWorkspace(deps, context, input) {
 }
 async function getHumanComposerDraft(deps, context) {
   await authorizeHumanSessionCommand(deps, context, "session.composer.read");
-  const row = await withWorkspaceSubjectRls2(
+  const row = await withWorkspaceSubjectRls3(
     deps.db,
     context.workspaceId,
     context.subjectId,
@@ -4641,6 +5327,7 @@ async function getHumanComposerDraft(deps, context) {
     text: "",
     resources: [],
     tools: [],
+    toolsProvided: false,
     model: session.model,
     reasoningEffort: reasoningEffortForMetadata2(session.metadata, "medium"),
     sourceTurnId: null,
@@ -4650,7 +5337,7 @@ async function getHumanComposerDraft(deps, context) {
 }
 async function saveHumanComposerDraft(deps, context, input) {
   await authorizeHumanSessionCommand(deps, context, "session.composer.write");
-  const row = await withWorkspaceSubjectRls2(
+  const row = await withWorkspaceSubjectRls3(
     deps.db,
     context.workspaceId,
     context.subjectId,
@@ -4678,6 +5365,7 @@ export {
   SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE,
   SessionAuthorizationDeniedError,
   SessionAuthorizationUnavailableError,
+  SessionSpawnDeniedError,
   acceptSessionUserMessage,
   activateRigVersionForApi,
   appendRigSetupCommand,
@@ -4686,12 +5374,15 @@ export {
   assertAllowedVariableSetVariableName,
   assertConfiguredModel,
   assertPackSandboxImageCompatible,
+  assertToolRefsSubset,
   assertWorkspaceDeletable,
   assertWorkspaceMemberRemovable,
   assertWorkspaceModelPolicyAllows,
+  availableToolRefs,
   buildCapabilityCatalog,
   buildFleetContextForSession,
   buildMarketingDailyAnalysisAgentConfig,
+  canonicalConfiguredModel,
   checkLimit,
   classifyRigVerificationOutcome,
   controlAgentSessionWorkstream,
@@ -4710,6 +5401,7 @@ export {
   editHumanQueuePrompt,
   enableCapability,
   enabledCapabilityMcpToolRefs,
+  getActorNewSessionDraft,
   getCapabilityPack,
   getHumanComposerDraft,
   hasPermission,
@@ -4755,15 +5447,19 @@ export {
   requireVariableSetForApi,
   resolveCapabilityPack,
   resolveMemberSubjectId,
+  resolveSessionToolPolicy,
   restoreScheduledTask,
   rigActorForGrant,
   routingEnabled,
   runOnSandbox,
+  saveActorNewSessionDraft,
   saveHumanComposerDraft,
   scheduledTaskTemporalScheduleId,
   scheduledTaskToolsProvided,
   scheduledTaskTriggerToken,
   sendAgentSessionMessage,
+  sessionSpawnDenialEnvelope,
+  sessionWithEffectiveToolPolicy,
   settingsWithEnabledCapabilityMcpServers,
   settingsWithMcpCapabilityServers,
   settingsWithSessionMcpServerMetadata,
@@ -4774,6 +5470,7 @@ export {
   syncCreatedScheduledTask,
   syncUpdatedScheduledTask,
   updateRigForApi,
+  updateSessionMcpApprovalPolicy,
   updateSessionTitle,
   validateFileResources,
   validateGitHubRepositorySelection,
@@ -4781,10 +5478,13 @@ export {
   validateGitHubRepositorySelectionShapes,
   validateMcpCapabilityConnection,
   validateToolRefs,
+  validateToolRefsForSessionPolicy,
   validateVariableSetAttachment,
   validatedScheduledTaskUpdate,
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
+  workspaceSessionToolPolicyDefaultServerIds,
+  workspaceSessionToolPolicyServerIds,
   wrapChannelABoxWithRouting
 };
 //# sourceMappingURL=index.js.map