@opengeni/core 2.2.0-canary.0 → 2.4.0-canary.0

package/dist/rigs/provider-images.d.ts

@@ -1,5 +1,5 @@
 import { type RigChangeVerification, type RigProviderImage, type RigProviderImages, type RigVersion, type SandboxBackend } from "@opengeni/contracts";
-export type RigProviderImageDefinition = Pick<RigVersion, "image" | "setupScript" | "checks" | "credentialHooks" | "defaultVariableSetIds">;
+export type RigProviderImageDefinition = Pick<RigVersion, "setupScript" | "checks" | "credentialHooks" | "defaultVariableSetIds">;
 export declare function rigProviderImageProviderBindingKeyHash(bindingKey: string): string;
 export declare function rigProviderImageSetupHash(definition: Pick<RigProviderImageDefinition, "setupScript">): string;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "2.2.0-canary.0",
+  "version": "2.4.0-canary.0",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -50,15 +50,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.19-canary.0",
-    "@opengeni/config": "^0.19.1-canary.0",
-    "@opengeni/contracts": "^2.3.0-canary.0",
-    "@opengeni/db": "^3.2.0-canary.0",
-    "@opengeni/documents": "^0.7.0-canary.0",
-    "@opengeni/events": "^0.3.124-canary.0",
-    "@opengeni/observability": "^0.8.4-canary.0",
-    "@opengeni/runtime": "^1.3.1-canary.0",
-    "@opengeni/storage": "^0.2.106-canary.0",
+    "@opengeni/codex": "^0.2.19-canary.1",
+    "@opengeni/config": "^0.20.1-canary.0",
+    "@opengeni/contracts": "^2.5.0-canary.0",
+    "@opengeni/db": "^3.4.0-canary.0",
+    "@opengeni/documents": "^0.8.2-canary.0",
+    "@opengeni/events": "^0.4.0-canary.0",
+    "@opengeni/observability": "^0.8.6-canary.0",
+    "@opengeni/runtime": "^1.4.0-canary.0",
+    "@opengeni/storage": "^0.2.108-canary.0",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/access/index.ts

@@ -388,6 +388,7 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
         email: session.user.email,
         name: session.user.name,
         emailVerified: session.user.emailVerified,
+        provisionFallbackOrganization: false,
       });
       canonicalManagedCookieContexts.add(context);
       return context;

package/src/application/new-session-drafts.ts

@@ -103,18 +103,32 @@ async function hydrateNewSessionDraft(
   }
 
   const options = { ...mapped.options };
-  if (options.variableSetId) {
-    if (
-      !hasPermission(grant.permissions, "variable-sets:attach") ||
-      !hasPermission(grant.permissions, "variable-sets:use") ||
-      !(await getVariableSet(
-        deps.db,
-        { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
-        options.variableSetId,
-      ))
-    ) {
+  const variableSetIds = options.variableSetIds ?? [];
+  if (variableSetIds.length > 0) {
+    const selectionsAuthorized =
+      hasPermission(grant.permissions, "variable-sets:attach") &&
+      hasPermission(grant.permissions, "variable-sets:use") &&
+      (
+        await Promise.all(
+          variableSetIds.map((variableSetId) =>
+            getVariableSet(
+              deps.db,
+              { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+              variableSetId,
+            ),
+          ),
+        )
+      ).every(Boolean);
+    if (selectionsAuthorized) {
+      options.variableSetIds = variableSetIds;
+      options.variableSetId = variableSetIds[variableSetIds.length - 1];
+    } else {
+      delete options.variableSetIds;
       delete options.variableSetId;
     }
+  } else {
+    delete options.variableSetIds;
+    delete options.variableSetId;
   }
   if (options.rigId) {
     const rig = await getRig(deps.db, workspaceId, options.rigId);

package/src/application/session-tenancy.ts

@@ -7,9 +7,11 @@ import {
   type ForkSessionRequest,
   type SessionAuthorizationSurface,
   type UpdateSessionVisibilityRequest,
+  type VariableSet,
 } from "@opengeni/contracts";
 import {
   forkSessionContent,
+  getRig,
   getPrivateSessionCreatePolicy,
   getSessionEventForSubject,
   isRetryableDatabaseTransportFailure,
@@ -17,6 +19,7 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   SessionTenancyAccessError,
+  SessionTenancyInvalidRequestError,
   SessionTenancyNotActivatedError,
   transitionSessionVisibility,
   type Database,
@@ -26,8 +29,12 @@ import { publishDurableSessionEvents, type EventBus } from "@opengeni/events";
 import { requirePermission, type AccessGrantAuthorization } from "../access";
 import { requireSessionAuthorization } from "../session-authorization";
 import type { AppDependencies } from "../dependencies";
+import { validateVariableSetAttachment } from "../domain/environments";
 
-type SessionTenancyDependencies = Pick<AppDependencies, "db" | "bus" | "sessionAuthorization">;
+type SessionTenancyDependencies = Pick<
+  AppDependencies,
+  "db" | "bus" | "sessionAuthorization" | "settings"
+>;
 
 export class SessionTenancyManagedHumanRequiredError extends Error {
   readonly name = "SessionTenancyManagedHumanRequiredError";
@@ -286,9 +293,72 @@ export async function forkManagedHumanSession(
       request.visibility === "private" ? ("user_private" as const) : ("workspace_shared" as const),
     workspaceSharedAcknowledged: request.workspaceSharedAcknowledged,
     operationKey: request.idempotencyKey,
+    ...(request.rigId !== undefined || request.variableSetIds !== undefined
+      ? {
+          runtimeRequest: {
+            rigId: request.rigId ?? null,
+            variableSetIds: request.variableSetIds ?? [],
+          },
+        }
+      : {}),
   };
   const recoverAppliedReceipt = async () =>
     await runTenancyMutation(async () => await replayAppliedSessionFork(deps.db, forkInput));
+  const runtimeSetupRequested = request.rigId !== undefined || request.variableSetIds !== undefined;
+  let runtimeConfigurationPromise: Promise<{
+    variableSetIds: string[];
+    rigId: string | null;
+    rigVersionId: string | null;
+  }> | null = null;
+  const resolveRuntimeConfiguration = async () => {
+    if (runtimeConfigurationPromise) return await runtimeConfigurationPromise;
+    runtimeConfigurationPromise = (async () => {
+      const variableSets: VariableSet[] = [];
+      for (const variableSetId of request.variableSetIds ?? []) {
+        variableSets.push(
+          await validateVariableSetAttachment(
+            { settings: deps.settings, db: deps.db },
+            authorization.grant,
+            workspaceId,
+            variableSetId,
+          ),
+        );
+      }
+      let rigVersionId: string | null = null;
+      if (request.rigId) {
+        requirePermission(authorization.grant, "rigs:use");
+        const rig = await getRig(deps.db, authorization.grant, request.rigId);
+        if (!rig?.activeVersion) {
+          throw new SessionTenancyInvalidRequestError();
+        }
+        for (const defaultVariableSetId of new Set(rig.activeVersion.defaultVariableSetIds)) {
+          await validateVariableSetAttachment(
+            { settings: deps.settings, db: deps.db },
+            authorization.grant,
+            workspaceId,
+            defaultVariableSetId,
+          );
+        }
+        rigVersionId = rig.activeVersion.id;
+      }
+      return {
+        variableSetIds: variableSets.map((variableSet) => variableSet.id),
+        rigId: request.rigId ?? null,
+        rigVersionId,
+      };
+    })();
+    return await runtimeConfigurationPromise;
+  };
+  const publishRuntimeConfiguration = async (result: ForkSessionContentResult) => {
+    if (!result.runtimeEventId || !result.runtimeEventSequence) return;
+    await publishExactCommittedEvent(deps, {
+      workspaceId,
+      sessionId: result.sessionId,
+      subjectId: authorization.grant.subjectId,
+      eventId: result.runtimeEventId,
+      eventSequence: result.runtimeEventSequence,
+    });
+  };
 
   // A committed response is owned by the exact actor/key/request tuple and no
   // longer depends on mutable source visibility. Resolve it before source/host
@@ -296,7 +366,13 @@ export async function forkManagedHumanSession(
   // owner makes a formerly shared session private.
   const applied = await recoverAppliedReceipt();
   if (applied) {
-    return await projectAndPublishSessionFork(deps, authorization.grant.subjectId, applied);
+    const response = await projectAndPublishSessionFork(
+      deps,
+      authorization.grant.subjectId,
+      applied,
+    );
+    await publishRuntimeConfiguration(applied);
+    return response;
   }
 
   try {
@@ -311,11 +387,28 @@ export async function forkManagedHumanSession(
     // exact applied receipt can convert the authorization failure into replay.
     const racedApplied = await recoverAppliedReceipt();
     if (racedApplied) {
-      return await projectAndPublishSessionFork(deps, authorization.grant.subjectId, racedApplied);
+      const response = await projectAndPublishSessionFork(
+        deps,
+        authorization.grant.subjectId,
+        racedApplied,
+      );
+      await publishRuntimeConfiguration(racedApplied);
+      return response;
     }
     throw authorizationError;
   }
 
-  const result = await runTenancyMutation(async () => await forkSessionContent(deps.db, forkInput));
-  return await projectAndPublishSessionFork(deps, authorization.grant.subjectId, result);
+  // Validate all requested runtime resources before committing the independent
+  // fork so ordinary authorization failures cannot leave an unusable copy.
+  const runtimeConfiguration = runtimeSetupRequested ? await resolveRuntimeConfiguration() : null;
+  const result = await runTenancyMutation(
+    async () =>
+      await forkSessionContent(deps.db, {
+        ...forkInput,
+        ...(runtimeConfiguration ? { runtimeConfiguration } : {}),
+      }),
+  );
+  const response = await projectAndPublishSessionFork(deps, authorization.grant.subjectId, result);
+  await publishRuntimeConfiguration(result);
+  return response;
 }

package/src/dependencies.ts

@@ -96,6 +96,36 @@ export type DocumentIndexClient = {
   }) => Promise<Document | void>;
 };
 
+export type ManagedEmailMessage = {
+  kind: "email_verification" | "password_reset" | "organization_user_setup";
+  from: string;
+  to: string;
+  subject: string;
+  text: string;
+  html: string;
+  idempotencyKey?: string;
+};
+
+export type ManagedEmailDeliveryResult =
+  | { status: "sent"; providerMessageId: string | null }
+  | { status: "failed"; errorClass: string }
+  | { status: "outcome_unknown"; errorClass: string };
+
+/** Provider-neutral, injectable boundary for every managed-auth email. */
+export type ManagedEmailTransport = {
+  /** Effective provider sender; frozen into any idempotent payload digest. */
+  readonly sender: string;
+  /**
+   * Stable non-secret provider/account/policy namespace plus the provider's
+   * guaranteed key-retention window. Both are durably fenced before I/O.
+   */
+  readonly idempotency: {
+    readonly scope: string;
+    readonly retentionSeconds: number;
+  };
+  send(message: ManagedEmailMessage): Promise<ManagedEmailDeliveryResult>;
+};
+
 export type AppDependencies = {
   settings: Settings;
   db: Database;
@@ -132,6 +162,8 @@ export type AppDependencies = {
    * App credentials; standalone deployments fall back to @opengeni/github.
    */
   githubAppApi?: GitHubAppApiPort;
+  /** Optional provider seam for the separately registered OpenGeni Lens App. */
+  prReviewGithubAppApi?: GitHubAppApiPort;
   /**
    * Optional host-owned connection credential seam. API-side consumers use
    * the MCP leg for Codemode/Code Mode; worker consumers bind the same port
@@ -145,6 +177,8 @@ export type AppDependencies = {
    */
   sessionAuthorization?: SessionAuthorizationPort | null;
   managedAuth?: ManagedAuth | null;
+  /** Injectable managed-email transport; standalone API defaults to Resend or local capture. */
+  managedEmailTransport?: ManagedEmailTransport;
   /** Injectable Codex HTTP transport for deterministic API/provider tests. */
   codexFetch?: typeof fetch;
   /** Injectable GitHub transport for deterministic personal-OAuth tests. */
@@ -188,6 +222,7 @@ export type AppDependencies = {
 export type ObjectStorageDependency = ReturnType<typeof createObjectStorage>;
 
 export type ApiRouteDeps = AppDependencies & {
+  managedEmailTransport: ManagedEmailTransport;
   objectStorage: ObjectStorageDependency;
   githubStateSecret: string;
   documentIndexer: DocumentIndexClient;

package/src/domain/insights.ts

@@ -5,14 +5,7 @@ import {
   type WorkspaceInsightsResponse,
 } from "@opengeni/contracts";
 import {
-  aggregateModelCallFacts,
-  aggregateModelCallFactsByDay,
-  aggregateModelCallFactsByHour,
-  aggregateModelContextContributions,
-  aggregateRootSessionDrivers,
-  aggregateScheduleFacts,
   aggregateSessionDepth,
-  aggregateWarmSecondsByGroup,
   countOnlineMachines,
   countScheduledTaskFires,
   countSessionsAttachedToGroups,
@@ -20,18 +13,47 @@ import {
   enumerateUtcHours,
   listFloorSessions,
   listLiveWarmLeases,
-  listModelCallFacets,
-  listRecentModelCalls,
   listScheduledTasks,
+  readWorkspaceInsightsModelBundle,
+  readWorkspaceInsightsUsageBundle,
   requireWorkspace,
-  sumUsageQuantity,
-  sumUsageQuantityByDay,
-  sumUsageQuantityByHour,
-  sumUsageQuantityInRange,
   type Database,
 } from "@opengeni/db";
 
 const MACHINE_HEARTBEAT_FRESH_MS = 120_000;
+export const WORKSPACE_INSIGHTS_PROVIDER_FILTER_MAX_UTF8_BYTES = 256;
+export const WORKSPACE_INSIGHTS_MODEL_FILTER_MAX_UTF8_BYTES = 512;
+
+export type WorkspaceInsightsFilterField = "provider" | "model";
+
+export class WorkspaceInsightsFilterValidationError extends Error {
+  readonly field: WorkspaceInsightsFilterField;
+  readonly maxUtf8Bytes: number;
+
+  constructor(field: WorkspaceInsightsFilterField, maxUtf8Bytes: number) {
+    super(`${field} must be at most ${maxUtf8Bytes} UTF-8 bytes`);
+    this.name = "WorkspaceInsightsFilterValidationError";
+    this.field = field;
+    this.maxUtf8Bytes = maxUtf8Bytes;
+  }
+}
+
+/** Normalize the public filter sentinel and enforce the database authority envelope. */
+export function normalizeWorkspaceInsightsFilter(
+  value: string | null | undefined,
+  field: WorkspaceInsightsFilterField,
+): string | null {
+  const normalized = value?.trim() || null;
+  if (normalized === null || normalized === "all") return null;
+  const maxUtf8Bytes =
+    field === "provider"
+      ? WORKSPACE_INSIGHTS_PROVIDER_FILTER_MAX_UTF8_BYTES
+      : WORKSPACE_INSIGHTS_MODEL_FILTER_MAX_UTF8_BYTES;
+  if (new TextEncoder().encode(normalized).byteLength > maxUtf8Bytes) {
+    throw new WorkspaceInsightsFilterValidationError(field, maxUtf8Bytes);
+  }
+  return normalized;
+}
 
 export type GetWorkspaceInsightsInput = {
   workspaceId: string;
@@ -174,167 +196,81 @@ function pricingSourceOf(
   return value === "configured_list_price" || value === "gateway_reported" ? value : null;
 }
 
+export function insightsSessionLabel(input: {
+  id: string;
+  title: string | null;
+  depth?: number | null;
+}): string {
+  const title = input.title?.trim();
+  if (title) return title;
+  return `${(input.depth ?? 0) > 0 ? "Agent" : "Session"} ${input.id.slice(0, 8)}`;
+}
+
 export async function getWorkspaceInsights(
   db: Database,
   settings: Settings,
   input: GetWorkspaceInsightsInput,
 ): Promise<WorkspaceInsightsResponse> {
+  const provider = normalizeWorkspaceInsightsFilter(input.provider, "provider");
+  const model = normalizeWorkspaceInsightsFilter(input.model, "model");
   await requireWorkspace(db, input.workspaceId);
   const now = input.now ?? new Date();
   const window = resolveRangeWindow(input.range, now);
-  const provider = input.provider?.trim() || null;
-  const model = input.model?.trim() || null;
   const modelFilterActive = Boolean(provider || model);
   const filter = { provider, model };
-  const aggregateFactsForSeries =
-    input.range === "today" ? aggregateModelCallFactsByHour : aggregateModelCallFactsByDay;
-  const sumUsageForSeries =
-    input.range === "today" ? sumUsageQuantityByHour : sumUsageQuantityByDay;
 
-  const [
-    workspaceCreditMicros,
-    priorWorkspaceCreditMicros,
-    warmSeconds,
-    priorWarmSeconds,
+  const [modelBundle, usageBundle, liveWarm, tasks, depth, floorRows, machinesOnline] =
+    await Promise.all([
+      readWorkspaceInsightsModelBundle(db, {
+        workspaceId: input.workspaceId,
+        since: window.since,
+        until: window.until,
+        priorSince: window.priorSince,
+        priorUntil: window.priorUntil,
+        granularity: input.range === "today" ? "hour" : "day",
+        ...filter,
+      }),
+      readWorkspaceInsightsUsageBundle(db, {
+        workspaceId: input.workspaceId,
+        since: window.since,
+        until: window.until,
+        priorSince: window.priorSince,
+        priorUntil: window.priorUntil,
+        monthSince: startOfUtcMonth(now),
+        granularity: input.range === "today" ? "hour" : "day",
+        warmGroupLimit: 24,
+      }),
+      listLiveWarmLeases(db, input.workspaceId),
+      listScheduledTasks(db, input.workspaceId, 100),
+      aggregateSessionDepth(db, input.workspaceId),
+      listFloorSessions(db, input.workspaceId, 24),
+      settings.sandboxSelfhostedEnabled
+        ? countOnlineMachines(db, input.workspaceId, MACHINE_HEARTBEAT_FRESH_MS, now)
+        : Promise.resolve(0),
+    ]);
+
+  const {
     modelRows,
     priorModelRows,
-    factDays,
-    warmDays,
-    costDays,
-    warmGroups,
-    liveWarm,
+    factBuckets: factDays,
     rootDrivers,
+    priorRootDrivers,
     scheduleFacts,
-    tasks,
-    depth,
-    floorRows,
-    machinesOnline,
-    billableTokensUsed,
-    agentRunsUsed,
     facets,
     recentCalls,
     promptContributions,
-  ] = await Promise.all([
-    sumUsageQuantityInRange(db, {
-      workspaceId: input.workspaceId,
-      eventType: "model.cost",
-      since: window.since,
-      until: window.until,
-    }),
-    sumUsageQuantityInRange(db, {
-      workspaceId: input.workspaceId,
-      eventType: "model.cost",
-      since: window.priorSince,
-      until: window.priorUntil,
-    }),
-    sumUsageQuantityInRange(db, {
-      workspaceId: input.workspaceId,
-      eventType: "sandbox.warm_seconds",
-      since: window.since,
-      until: window.until,
-    }),
-    sumUsageQuantityInRange(db, {
-      workspaceId: input.workspaceId,
-      eventType: "sandbox.warm_seconds",
-      since: window.priorSince,
-      until: window.priorUntil,
-    }),
-    aggregateModelCallFacts(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter,
-    }),
-    aggregateModelCallFacts(db, {
-      workspaceId: input.workspaceId,
-      since: window.priorSince,
-      until: window.priorUntil,
-      ...filter,
-    }),
-    aggregateFactsForSeries(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter,
-    }),
-    sumUsageForSeries(db, {
-      workspaceId: input.workspaceId,
-      eventType: "sandbox.warm_seconds",
-      since: window.since,
-      until: window.until,
-    }),
-    sumUsageForSeries(db, {
-      workspaceId: input.workspaceId,
-      eventType: "model.cost",
-      since: window.since,
-      until: window.until,
-    }),
-    aggregateWarmSecondsByGroup(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      limit: 24,
-    }),
-    listLiveWarmLeases(db, input.workspaceId),
-    aggregateRootSessionDrivers(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter,
-      limit: 8,
-    }),
-    aggregateScheduleFacts(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter,
-    }),
-    listScheduledTasks(db, input.workspaceId, 100),
-    aggregateSessionDepth(db, input.workspaceId),
-    listFloorSessions(db, input.workspaceId, 24),
-    settings.sandboxSelfhostedEnabled
-      ? countOnlineMachines(db, input.workspaceId, MACHINE_HEARTBEAT_FRESH_MS, now)
-      : Promise.resolve(0),
-    sumUsageQuantity(db, {
-      workspaceId: input.workspaceId,
-      eventType: "model.tokens",
-      since: startOfUtcMonth(now),
-    }),
-    sumUsageQuantity(db, {
-      workspaceId: input.workspaceId,
-      eventType: "agent_run.created",
-      since: startOfUtcMonth(now),
-    }),
-    listModelCallFacets(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-    }),
-    listRecentModelCalls(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter,
-      limit: 50,
-    }),
-    aggregateModelContextContributions(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter,
-    }),
-  ]);
-
-  const [priorRootDrivers, attached, fireCounts] = await Promise.all([
-    // Exact prior costs for the current top drivers — never a separate top-N page that
-    // drops roots and invents +$full as "new" spend.
-    aggregateRootSessionDrivers(db, {
-      workspaceId: input.workspaceId,
-      since: window.priorSince,
-      until: window.priorUntil,
-      ...filter,
-      rootSessionIds: rootDrivers.map((row) => row.rootSessionId),
-    }),
+  } = modelBundle;
+  const {
+    workspaceCreditMicros,
+    priorWorkspaceCreditMicros,
+    warmSeconds,
+    priorWarmSeconds,
+    buckets: usageBuckets,
+    warmGroups,
+    billableTokensUsed,
+    agentRunsUsed,
+  } = usageBundle;
+  const [attached, fireCounts] = await Promise.all([
     countSessionsAttachedToGroups(
       db,
       input.workspaceId,
@@ -419,13 +355,13 @@ export async function getWorkspaceInsights(
     };
     const modelCostMicros = modelFilterActive
       ? facts.costMicros
-      : (costDays.get(bucket) ?? facts.costMicros);
+      : (usageBuckets.get(bucket)?.costMicros ?? facts.costMicros);
     return {
       label: input.range === "today" ? bucket.slice(11) : bucket.slice(5),
       modelCostUsd: microsToUsd(modelCostMicros),
       estimatedProviderUsd: microsToUsd(facts.estimatedProviderCostMicros),
       estimatedProviderCostKnownCalls: facts.estimatedProviderCostKnownCalls,
-      warmSeconds: warmDays.get(bucket) ?? 0,
+      warmSeconds: usageBuckets.get(bucket)?.warmSeconds ?? 0,
       inputTokens: facts.inputTokens,
       outputTokens: facts.outputTokens,
       cachedTokens: facts.cachedTokens,
@@ -453,7 +389,7 @@ export async function getWorkspaceInsights(
     return {
       id: `root:${row.rootSessionId}`,
       groupBy: "root_session" as const,
-      label: row.title?.trim() || row.rootSessionId.slice(0, 8),
+      label: insightsSessionLabel({ id: row.rootSessionId, title: row.title, depth: 0 }),
       creditUsd,
       estimatedProviderUsd: microsToUsd(row.estimatedProviderCostMicros),
       estimatedProviderCostKnownCalls: row.estimatedProviderCostKnownCalls,
@@ -494,7 +430,11 @@ export async function getWorkspaceInsights(
     })
     .map((row) => ({
       id: row.id,
-      title: row.title?.trim() || "Untitled session",
+      title: insightsSessionLabel({
+        id: row.id,
+        title: row.title,
+        depth: row.nestedAgentDepth,
+      }),
       state: floorState(row),
       depth: row.nestedAgentDepth,
       model: row.model,
@@ -528,7 +468,11 @@ export async function getWorkspaceInsights(
       occurredAt: row.occurredAt.toISOString(),
       recordedAt: row.recordedAt.toISOString(),
       sessionId: row.sessionId,
-      sessionTitle: row.sessionTitle?.trim() || "Untitled session",
+      sessionTitle: insightsSessionLabel({
+        id: row.sessionId,
+        title: row.sessionTitle,
+        depth: row.sessionDepth,
+      }),
       turnId: row.turnId,
       provider: row.provider,
       providerApi: row.providerApi,
@@ -588,7 +532,13 @@ export async function getWorkspaceInsights(
     sessionsTouched: depth.sessionsTouched,
     rootSessions: depth.rootSessions,
     deepestDepth: depth.deepestDepth,
-    deepestSessionTitle: depth.deepestSessionTitle || "",
+    deepestSessionTitle: depth.deepestSessionId
+      ? insightsSessionLabel({
+          id: depth.deepestSessionId,
+          title: depth.deepestSessionTitle,
+          depth: depth.deepestDepth,
+        })
+      : "",
     avgDepth: Math.round(depth.avgDepth * 10) / 10,
     warmIdleNow: liveWarm.filter((lease) => lease.turnHolders === 0).length,
     billableTokensUsed,

package/src/domain/organization-membership-lifecycle.ts

@@ -4,6 +4,7 @@ export function organizationMembershipHttpStatus(
   if (sqlState === "22023" || sqlState === "23514") return 400;
   if (sqlState === "42501") return 403;
   if (sqlState === "P0002") return 404;
-  if (sqlState === "23505" || sqlState === "40001" || sqlState === "55000") return 409;
+  if (sqlState === "23505" || sqlState === "40001" || sqlState === "55000" || sqlState === "55P03")
+    return 409;
   return null;
 }