@opengeni/core 3.0.1 → 4.0.0

package/src/domain/sessions.ts

@@ -1,21 +1,18 @@
+import { acceptSessionFileAttachments } from "@opengeni/db";
 import { knowledgeContextForAccess } from "./knowledge";
+import {
+  getSessionEvent,
+  getSessionRetryReceiptInTransaction,
+  retryFailedSessionInTransaction,
+  SessionRetryConflictError,
+} from "@opengeni/db";
+import type { SessionRetryRequest, SessionRetryResponse } from "@opengeni/contracts";
 import { saveAgentLearningSettings } from "@opengeni/db";
 import { withSessionRlsActorContext } from "@opengeni/db";
 import { fileOwnerContextForAccess, fileOwnerContextForAgent } from "./file-owner";
 import { CODEX_MODEL_ID_PREFIX, isCodexBilledModel } from "@opengeni/codex";
 import { sessionCreationMetadata } from "../site-session-origin";
-import {
-  hostMcpBindingMatchesSelection,
-  HostMcpCreateSelections,
-  type HostMcpCreateSelection,
-} from "@opengeni/contracts/host-mcp-bindings";
-import {
-  captureDirectHostMcpAuthority,
-  HostMcpDelegationAuthorityError,
-  HostMcpBindingConflictError,
-  getHostMcpBinding,
-  getHostMcpDelegation,
-} from "@opengeni/db";
+
 import {
   canonicalizeConfiguredModelId,
   configuredAllowedModels,
@@ -55,7 +52,8 @@ import {
   type GoalSpec,
   type FirstPartyMcpToolName,
   type McpPersonalConnectionDelegation,
-  type McpConnectionAuthoritySelection,
+  type McpConnectionAccountBinding,
+  type McpConnectionAccountSelection,
   type Permission,
   type PersonalResourceAttachmentIntent,
   type ReasoningEffort,
@@ -71,6 +69,7 @@ import {
   type SessionMcpCredentialUpdateInput,
   type SessionMcpServerInput,
   type SessionMcpServerMetadata,
+  type SessionMcpApprovalPolicyTarget,
   type SubmittedTimelineAnnotation,
   type TimelineAnnotation,
   type UpdateSessionMcpApprovalPolicyResponse,
@@ -101,6 +100,8 @@ import {
   listDistinctVariableSetSelectionsInGroup,
   listDistinctRigVersionIdsInGroup,
   listInstalledPortableSkills,
+  listEnabledMcpCapabilityServers,
+  requireApprovalWithFloor,
   getSandbox,
   getSession,
   getInitializedSessionCreateReplay,
@@ -153,7 +154,7 @@ import { hasPermission, requirePermission, type AccessGrantAuthorization } from
 import { externalCreationMetadata } from "./external-creation-attribution";
 import { prepareExternalLinkTurnAdmission } from "../application/external-link-work-admission";
 import { externalContinuationCommitAuthorizer } from "../application/external-continuation";
-import { prepareHostMcpOwnerAuthorization } from "../application/host-mcp-owner";
+
 import { recordWorkspaceUsage, requireLimit } from "../billing/limits";
 import type {
   AcceptSessionUserMessageDependencies,
@@ -166,7 +167,7 @@ import {
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
 } from "../session-authorization";
-import { assertHostMcpAuthoritySourceAdmissionEnabled } from "./host-mcp-authority-source-admission";
+import { assertNativeMcpConnectionRef } from "./native-mcp-connection-admission";
 import {
   preflightCreateTimeSandboxTarget,
   swapActiveSandbox,
@@ -183,7 +184,7 @@ import { settingsWithEnabledCapabilityMcpServers } from "./capabilities";
 import { validateSubmittedTimelineAnnotations } from "./timeline-annotations";
 import { requireVariableSetEncryption, validateVariableSetAttachment } from "./environments";
 import {
-  freezePersonalConnectionDelegations,
+  freezeConnectionAccounts,
   personalConnectionDelegationSourceForGrant,
 } from "./personal-connection-delegations";
 import { hasReservedOpenGeniSlackBotSessionMetadata } from "./slack-bot";
@@ -209,6 +210,26 @@ const maxSessionMcpCredentialHeaderValueLength = 4096;
 // the generic lossy projection cannot silently rewrite this audit fact.
 const maxToolPolicyAuditRefs = 40;
 
+function withoutExcludedMcpServers(
+  tools: ToolRef[],
+  excludedIds: readonly string[] = [],
+): ToolRef[] {
+  const excluded = new Set(excludedIds);
+  return tools.filter((tool) => tool.id === "opengeni" || !excluded.has(tool.id));
+}
+
+function defaultPolicyExclusions(
+  ids: readonly string[] = [],
+): Pick<SessionToolPolicy, "excludedMcpServerIds"> {
+  const sorted = [...new Set(ids)].filter((id) => id !== "opengeni").sort();
+  if (sorted.length > 64 || sorted.some((id) => id.length > 200 || !/^[A-Za-z0-9_-]+$/.test(id))) {
+    throw new HTTPException(422, {
+      message: "connector exclusions must contain at most 64 valid MCP server IDs",
+    });
+  }
+  return sorted.length ? { excludedMcpServerIds: sorted } : {};
+}
+
 function isCatalogOverlayModel(modelId: string | null | undefined): boolean {
   return (
     modelId?.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) === true ||
@@ -566,7 +587,7 @@ function validateSessionMcpServersForCreate(
   const dbServers: CreateSessionMcpServerInput[] = [];
   const metadata: SessionMcpServerMetadata[] = [];
   for (const server of servers) {
-    assertHostMcpAuthoritySourceAdmissionEnabled(settings, server.connectionRef);
+    assertNativeMcpConnectionRef(server.connectionRef);
     if (seenIds.has(server.id)) {
       throw new HTTPException(422, {
         message: `duplicate session MCP server id: ${server.id}`,
@@ -760,7 +781,7 @@ export async function createAndStartSessionWithOutcome(input: {
   captureInitialTurnAuthority?: (tx: Database, sessionId: string, turnId: string) => Promise<void>;
   /** Internal replay identity; the verified caller must also capture authority.
    * Supplying selection metadata alone never grants runtime use. */
-  selectedHostMcpDelegations?: HostMcpCreateSelection[];
+
   /** The custom workspace model was frozen by an earlier accepted boundary or
    * inherited from an existing session, so retirement must not invalidate it. */
   retainWorkspaceGatewayModel?: boolean;
@@ -838,8 +859,10 @@ export async function createAndStartSessionWithOutcome(input: {
   // Encrypted DB rows plus matching safe metadata for create-time per-session
   // MCP servers. Metadata is the only shape emitted in events/responses.
   mcpServers?: CreateSessionMcpServerInput[];
+  mcpApprovalPolicies?: Record<string, SessionMcpApprovalPolicy>;
   sessionMcpServers?: SessionMcpServerMetadata[];
   personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+  mcpAccountBindings?: McpConnectionAccountBinding[] | null;
   initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
   xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
   // The manager session spawning this worker (a worker-signed sessionId claim
@@ -1034,7 +1057,7 @@ export async function createAndStartSessionWithOutcome(input: {
       toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
       initialAgentLearning: input.initialAgentLearning,
-      selectedHostMcpDelegations: input.selectedHostMcpDelegations ?? [],
+
       ...(input.createdBy ? { createdBy: input.createdBy } : {}),
       ...(frozenCreatedByContext ? { createdByContext: frozenCreatedByContext } : {}),
       createdByActor: input.createdByActor ?? null,
@@ -1060,7 +1083,9 @@ export async function createAndStartSessionWithOutcome(input: {
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
       mcpServers: input.mcpServers ?? [],
+      mcpApprovalPolicies: input.mcpApprovalPolicies ?? {},
       personalConnectionDelegations: input.personalConnectionDelegations ?? [],
+      mcpAccountBindings: input.mcpAccountBindings ?? null,
       initialPersonalResourceAttachmentIntent:
         input.initialPersonalResourceAttachmentIntent ?? null,
       ...(input.xaiProviderAccountAuthoritySnapshot
@@ -1131,7 +1156,7 @@ export async function createAndStartSessionWithOutcome(input: {
       metadata: sessionMetadata,
       initialAgentLearning: input.initialAgentLearning,
       ...(input.createdBy ? { createdBy: input.createdBy } : {}),
-      selectedHostMcpDelegations: input.selectedHostMcpDelegations ?? [],
+
       ...(frozenCreatedByContext ? { createdByContext: frozenCreatedByContext } : {}),
       createdByActor: input.createdByActor ?? null,
       model: input.model,
@@ -1154,7 +1179,9 @@ export async function createAndStartSessionWithOutcome(input: {
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
       mcpServers: input.mcpServers ?? [],
+      mcpApprovalPolicies: input.mcpApprovalPolicies ?? {},
       personalConnectionDelegations: input.personalConnectionDelegations ?? [],
+      mcpAccountBindings: input.mcpAccountBindings ?? null,
       initialPersonalResourceAttachmentIntent:
         input.initialPersonalResourceAttachmentIntent ?? null,
       ...(input.xaiProviderAccountAuthoritySnapshot
@@ -1325,6 +1352,9 @@ async function finishStartSession(
           ...(input.goal.rootConstraints !== undefined
             ? { rootConstraints: input.goal.rootConstraints }
             : {}),
+          ...(input.goal.reportRequirements !== undefined
+            ? { reportRequirements: input.goal.reportRequirements }
+            : {}),
           ...(input.goal.maxAutoContinuations !== undefined
             ? { maxAutoContinuations: input.goal.maxAutoContinuations }
             : {}),
@@ -1547,7 +1577,8 @@ type PostUserMessageTurnInput = {
   clientEventId?: string;
   mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];
   personalConnectionDelegations?: McpPersonalConnectionDelegation[];
-  selectedHostMcpDelegations?: HostMcpCreateSelection[];
+  mcpAccountBindings?: McpConnectionAccountBinding[] | null;
+
   captureTurnAuthority?: (tx: Database, turnId: string) => Promise<void>;
   personalResourceAttachment?: PersonalResourceAttachmentIntent;
   delivery?: "send" | "steer";
@@ -1755,9 +1786,8 @@ export async function postUserMessageTurn(
                 ? { recordAgentRunUsage: input.recordAgentRunUsage }
                 : {}),
               personalConnectionDelegations: input.personalConnectionDelegations ?? [],
-              ...(input.selectedHostMcpDelegations?.length
-                ? { selectedHostMcpDelegations: input.selectedHostMcpDelegations }
-                : {}),
+              mcpAccountBindings: input.mcpAccountBindings ?? null,
+
               ...(input.captureTurnAuthority
                 ? { captureTurnAuthority: input.captureTurnAuthority }
                 : {}),
@@ -1981,6 +2011,116 @@ async function resolveWorkspaceModelBoundarySettings(
   ).settings;
 }
 
+/** Explicit recovery, never a new prompt or a Pause/Resume command. */
+export async function retryFailedSession(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  workspaceId: string,
+  sessionId: string,
+  request: SessionRetryRequest,
+): Promise<SessionRetryResponse> {
+  requirePermission(grant, "sessions:control");
+  await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.control",
+    surface: "core",
+  });
+  const replay = await withWorkspaceSubjectSessionActivityRls(
+    deps.db,
+    workspaceId,
+    grant.subjectId,
+    async (db) =>
+      await getSessionRetryReceiptInTransaction(db, {
+        workspaceId,
+        sessionId,
+        subjectId: grant.subjectId,
+        request,
+      }),
+  );
+  if (replay) return replay;
+  const session = await requireSession(deps.db, workspaceId, sessionId);
+  const failure = await getSessionEvent(deps.db, workspaceId, request.failureEventId);
+  if (!failure || failure.sessionId !== sessionId)
+    throw new SessionRetryConflictError("RETRY_STALE_FAILURE", "The failure event is unavailable");
+  const turn = failure?.turnId ? await getSessionTurn(deps.db, workspaceId, failure.turnId) : null;
+  const retainedModel = turn?.model ?? session.model;
+  const settings = await resolveWorkspaceModelBoundarySettings(
+    deps,
+    grant,
+    workspaceId,
+    [request.model ?? retainedModel],
+    retainedModel,
+  );
+  const model = canonicalConfiguredModel(settings, request.model ?? retainedModel)!;
+  try {
+    assertSessionAllowsProductModel(session, model);
+  } catch (error) {
+    if (error instanceof CodexCompactionV2ProviderLockedError)
+      throw new HTTPException(422, { message: error.message, cause: error });
+    throw error;
+  }
+  await assertWorkspaceModelPolicyAllows(deps.db, settings, workspaceId, model);
+  const executionPolicy = resolveTurnExecutionPolicyV1(settings, {
+    modelId: model,
+    requestedModelId: request.model ?? null,
+    modelSource: request.model === undefined ? "session" : "explicit",
+    reasoningEffort: request.reasoningEffort ?? turn?.reasoningEffort ?? session.reasoningEffort,
+    reasoningSource: request.reasoningEffort === undefined ? "session" : "explicit",
+    latencyMode: request.latencyMode ?? turn?.latencyMode ?? session.latencyMode,
+    latencyModeSource: request.latencyMode === undefined ? "session" : "explicit",
+  });
+  await requireLimit(deps, {
+    accountId: grant.accountId,
+    workspaceId,
+    action: "agent_run:create",
+    quantity: 1,
+    model,
+  });
+  const result = await runIdempotentPersistenceTransaction(
+    {
+      stage: "session.retry",
+      eventTypes: ["turn.recovery.requested", "session.status.changed"],
+      maxAttempts: 3,
+    },
+    async () =>
+      await withWorkspaceSubjectSessionActivityRls(
+        deps.db,
+        workspaceId,
+        grant.subjectId,
+        async (db) =>
+          await retryFailedSessionInTransaction(db, {
+            accountId: grant.accountId,
+            workspaceId,
+            sessionId,
+            subjectId: grant.subjectId,
+            request,
+            executionPolicy,
+          }),
+      ),
+  );
+  // Fanout and workflow dispatch are reconstructible after the durable commit.
+  // Never report an admitted retry as failed because one notification is down.
+  void Promise.all([
+    deps.workflowClient.requestSessionWorkflowWakeDispatch(),
+    (async () => {
+      const events = await Promise.all(
+        result.eventIds.map((id) => getSessionEvent(deps.db, workspaceId, id)),
+      );
+      await publishDurableSessionEvents(
+        deps.bus,
+        workspaceId,
+        sessionId,
+        events.filter((event): event is SessionEvent => event !== null),
+      );
+    })(),
+  ]).catch(() => {
+    console.warn("[sessions] retry notification failed; durable recovery remains", {
+      errorCode: "session_retry_notification_failed",
+    });
+  });
+  return { outcome: result.outcome, turnId: result.turnId, failureEventId: result.failureEventId };
+}
+
 async function withSessionCreateUsageRecording(input: {
   deps: ApiRouteDeps;
   grant: AccessGrant;
@@ -2027,24 +2167,7 @@ async function createSessionForRequestInFileScope(
   payload.metadata = sessionCreationMetadata(payload.metadata);
   const creationMetadata = externalCreationMetadata(payload.metadata, authorization, grant);
   const externalBeforeCreateCommit = externalContinuationCommitAuthorizer(authorization);
-  const hostSelections = payload.selectedHostMcpDelegations ?? [];
-  if (
-    hostSelections.length &&
-    (!authorization ||
-      authorization.grant.accountId !== grant.accountId ||
-      authorization.grant.subjectId !== grant.subjectId ||
-      authorization?.grant.workspaceId !== workspaceId ||
-      !hasPermission(authorization?.grant.permissions ?? [], "connections:read") ||
-      !hasPermission(grant.permissions, "connections:read") ||
-      grant.metadata?.["sessionId"] ||
-      payload.startMode === "realtime")
-  ) {
-    throw new HTTPException(403, {
-      message: "Host selection requires a verified direct owner and non-realtime start",
-    });
-  }
-  if (hostSelections.length)
-    prepareHostMcpOwnerAuthorization(authorization!, workspaceId, "connections:read");
+
   if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
     throw new HTTPException(422, {
       message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,
@@ -2193,7 +2316,7 @@ async function createSessionForRequestInFileScope(
         selectedInstalledSkillIds: payload.installedSkillIds ?? [],
         initialAgentLearning: payload.agentLearning,
         ...sessionScope,
-        selectedHostMcpDelegations: hostSelections,
+
         ...(payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {}),
         visibility: effectiveVisibility,
         variableSetIds: payload.variableSetIds ?? [],
@@ -2351,6 +2474,23 @@ async function createSessionForRequestInFileScope(
     capabilityRuntimeSettings,
     sessionMcpServers.runtimeServers,
   );
+  const requestedMcpPolicies =
+    payload.mcpApprovalPolicies ?? parentSession?.mcpApprovalPolicies ?? {};
+  const mcpApprovalPolicies: Record<string, SessionMcpApprovalPolicy> = {};
+  if (Object.keys(requestedMcpPolicies).length > 0) {
+    requirePermission(grant, "sessions:control");
+    const inheritedServers = await listEnabledMcpCapabilityServers(db, workspaceId);
+    for (const [id, policy] of Object.entries(requestedMcpPolicies)) {
+      const inherited = inheritedServers.find((server) => server.id === id);
+      if (!inherited || sessionMcpServers.runtimeServers.some((server) => server.id === id)) {
+        throw new HTTPException(422, {
+          message: `MCP approval policy must name an enabled inherited capability: ${id}`,
+        });
+      }
+      mcpApprovalPolicies[id] =
+        requireApprovalWithFloor(policy, inherited.approvalFloor, true) ?? false;
+    }
+  }
   const resources = normalizeResources(
     hasOwnProperty(rawPayload, "resources")
       ? payload.resources
@@ -2395,6 +2535,11 @@ async function createSessionForRequestInFileScope(
     });
   }
   const toolsProvided = hasOwnProperty(rawPayload, "tools");
+  if (toolsProvided && payload.excludedMcpServerIds !== undefined) {
+    throw new HTTPException(422, {
+      message: "connector exclusions require workspace-default tools",
+    });
+  }
   // Visibility became durable draft state after older clients had already
   // written rows without it. Compare it only when the create request supplied
   // the field explicitly; the parsed schema default must not manufacture a
@@ -2417,6 +2562,9 @@ async function createSessionForRequestInFileScope(
           )
         : parentSession.tools,
       runtimeSettings,
+    ).filter(
+      (tool) =>
+        tool.id === "opengeni" || !parentSession.toolPolicy.excludedMcpServerIds?.includes(tool.id),
     );
     if (toolsProvided) {
       assertToolRefsSubset(
@@ -2434,6 +2582,7 @@ async function createSessionForRequestInFileScope(
       toolPolicy = {
         mode: parentTracksWorkspaceDefaults ? "workspace_default" : "inherited",
         inheritedFromSessionId: parentSession.id,
+        ...defaultPolicyExclusions(parentSession.toolPolicy.excludedMcpServerIds),
       };
     }
   } else if (toolsProvided) {
@@ -2448,19 +2597,27 @@ async function createSessionForRequestInFileScope(
     );
     toolPolicy = { mode: "workspace_default", inheritedFromSessionId: null };
   }
+  if (payload.excludedMcpServerIds !== undefined) {
+    if (toolPolicy.mode !== "workspace_default") {
+      throw new HTTPException(403, {
+        message: "connector exclusions require workspace-default tools",
+      });
+    }
+    toolPolicy = {
+      ...toolPolicy,
+      ...defaultPolicyExclusions([
+        ...(toolPolicy.excludedMcpServerIds ?? []),
+        ...payload.excludedMcpServerIds,
+      ]),
+    };
+  }
+  selectedTools = withoutExcludedMcpServers(selectedTools, toolPolicy.excludedMcpServerIds);
   // The first-party MCP server is attached to EVERY session. Registration is
   // independently intersected with the exact model-visible selection and the
   // tool's permission/target authorization predicate, so attachment alone
   // exposes nothing.
   const tools = withFirstPartyTools(selectedTools, runtimeSettings);
-  const captureSelectedHostAuthority = prepareSelectedHostTurnAuthority(
-    runtimeSettings,
-    tools,
-    grant,
-    workspaceId,
-    hostSelections,
-    authorization,
-  );
+
   const captureLinkedAuthority = prepareExternalLinkTurnAdmission(authorization);
   await validateGitHubRepositorySelection(db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
@@ -2468,20 +2625,20 @@ async function createSessionForRequestInFileScope(
       message: "object storage is not configured",
     });
   }
+  const attachmentOwnerContext = authorization
+    ? await fileOwnerContextForAccess({ db }, authorization, "sessions:create")
+    : grant.principalKind === "agent_attempt"
+      ? await fileOwnerContextForAgent({ db }, grant, "sessions:create")
+      : undefined;
+  const attachmentOwner =
+    attachmentOwnerContext?.privateFileOwnerSubjectId === grant.subjectId ? grant.subjectId : null;
   await validateFileResources(
     db,
     grant.accountId,
     workspaceId,
     personalResourceSubjectId ?? grant.subjectId,
     resources,
-    (authorization || grant.principalKind === "agent_attempt") &&
-      (effectiveVisibility === "user_private" ||
-        sessionScope.memoryScope === "user" ||
-        workspace.kind === "personal")
-      ? authorization
-        ? await fileOwnerContextForAccess({ db }, authorization, "sessions:create")
-        : await fileOwnerContextForAgent({ db }, grant, "sessions:create")
-      : undefined,
+    attachmentOwnerContext,
   );
   // Every selected Variable Set is independently authorized. Scope does not
   // affect precedence: explicit order is low-to-high and later sets win name
@@ -2513,7 +2670,7 @@ async function createSessionForRequestInFileScope(
       if (payload.rigId) {
         throw new HTTPException(422, {
           message: rig
-            ? `rig ${payload.rigId} has no active version to bind`
+            ? `sandbox environment ${payload.rigId} has no active version to bind`
             : `unknown rigId: ${payload.rigId}`,
         });
       }
@@ -2584,6 +2741,9 @@ async function createSessionForRequestInFileScope(
           reasoningEffort,
           latencyMode,
           options: {
+            ...(payload.excludedMcpServerIds !== undefined
+              ? { excludedMcpServerIds: payload.excludedMcpServerIds }
+              : {}),
             ...(visibilityProvided ? { visibility: payload.visibility } : {}),
             ...(payload.sandboxBackend ? { sandboxBackend: payload.sandboxBackend } : {}),
             ...(payload.targetSandboxId ? { targetSandboxId: payload.targetSandboxId } : {}),
@@ -2730,14 +2890,15 @@ async function createSessionForRequestInFileScope(
   const atlassianEnabled =
     firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
     (!firstPartyMcpPermissions?.length || firstPartyMcpPermissions.includes("connections:read"));
-  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+  const { personalConnectionDelegations, mcpAccountBindings } = await freezeConnectionAccounts({
     db,
+    accountId: grant.accountId,
     workspaceId,
     settings: runtimeSettings,
     tools,
     resources,
     source: connectionDelegationSource,
-    authoritySelections: payload.connectionAuthorities,
+    authoritySelections: payload.connectionAccounts,
     googleDrivePublicationEnabled,
     atlassianEnabled,
   });
@@ -2862,7 +3023,7 @@ async function createSessionForRequestInFileScope(
         throw new HTTPException(422, {
           message: variableSetMismatch
             ? "sandbox:'shared' requires the same variableSet / same environment as the creator's box (the box variable set/environment is fixed at creation); omit sandbox or pass 'new' when attaching a different variableSet/environment."
-            : "sandbox:'shared' requires the same rig as the creator's box (the box's rig setup is fixed at creation); omit sandbox or pass 'new' when binding a different rig.",
+            : "sandbox:'shared' requires the same sandbox environment as the creator's box (setup is fixed at creation); omit sandbox or pass 'new' when selecting a different sandbox environment.",
         });
       }
       // Inherited default: deterministic separation on the genuine shared-state
@@ -2925,7 +3086,7 @@ async function createSessionForRequestInFileScope(
         )
       ) {
         throw new HTTPException(422, {
-          message: `sandbox group ${sandboxChoice.groupId} runs a different rig (the box's rig setup is fixed at creation); create with the group's rig or omit sandbox for an own box.`,
+          message: `sandbox group ${sandboxChoice.groupId} uses a different sandbox environment (setup is fixed at creation); select the group's sandbox environment or omit sandbox for a separate box.`,
         });
       }
     }
@@ -3118,8 +3279,8 @@ async function createSessionForRequestInFileScope(
       sandboxGroupId,
       metadata: creationMetadata ?? {},
       ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
-      selectedHostMcpDelegations: hostSelections,
-      ...(captureSelectedHostAuthority || captureLinkedAuthority
+
+      ...(payload.startMode !== "realtime"
         ? {
             captureInitialTurnAuthority: async (
               tx: Database,
@@ -3127,7 +3288,15 @@ async function createSessionForRequestInFileScope(
               turnId: string,
             ) => {
               await captureLinkedAuthority?.(tx, sessionId, turnId);
-              await captureSelectedHostAuthority?.(tx, sessionId, turnId);
+              if (attachmentOwner)
+                await acceptSessionFileAttachments(tx, {
+                  accountId: grant.accountId,
+                  workspaceId,
+                  sessionId,
+                  turnId,
+                  subjectId: attachmentOwner,
+                  resources,
+                });
             },
           }
         : {}),
@@ -3156,8 +3325,10 @@ async function createSessionForRequestInFileScope(
       firstPartyMcpPermissions,
       firstPartyMcpTools,
       mcpServers: sessionMcpServers.dbServers,
+      mcpApprovalPolicies,
       sessionMcpServers: sessionMcpServers.metadata,
       personalConnectionDelegations,
+      mcpAccountBindings,
       initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
       workspaceCustomModel: isWorkspaceCustomModelId(settings, model),
       retainWorkspaceCustomModel: parentSession !== null && model === inheritedModel,
@@ -3213,18 +3384,7 @@ async function createSessionForRequestInFileScope(
         { message: error.message, cause: error },
       );
     }
-    if (error instanceof HostMcpDelegationAuthorityError) {
-      throw new HTTPException(403, {
-        message: "Host delegation authority unavailable",
-        cause: error,
-      });
-    }
-    if (error instanceof HostMcpBindingConflictError) {
-      throw new HTTPException(409, {
-        message: "Host delegation selection conflicts",
-        cause: error,
-      });
-    }
+
     if (error instanceof AgentCommandAuthorityError) {
       throw new HTTPException(403, { message: error.message });
     }
@@ -3279,89 +3439,6 @@ export async function createSessionForRequest(
   ).session;
 }
 
-/** Snapshot the selected destination, then recheck live actor, binding and grant
- * inside the transaction which accepts the turn. Neither selection nor a
- * registered binding alone is execution authority. Shared by create/send/steer. */
-function prepareSelectedHostTurnAuthority(
-  settings: Settings,
-  tools: ToolRef[],
-  grant: AccessGrant,
-  workspaceId: string,
-  selections: HostMcpCreateSelection[],
-  authorization?: AccessGrantAuthorization,
-): ((tx: Database, sessionId: string, turnId: string) => Promise<void>) | undefined {
-  if (!selections.length) return undefined;
-  if (
-    !authorization ||
-    authorization.grant.accountId !== grant.accountId ||
-    authorization.grant.subjectId !== grant.subjectId ||
-    authorization?.grant.workspaceId !== workspaceId ||
-    !hasPermission(authorization?.grant.permissions ?? [], "connections:read") ||
-    !hasPermission(grant.permissions, "connections:read") ||
-    grant.metadata?.["sessionId"]
-  )
-    throw new HTTPException(403, {
-      message: "Host selection requires a verified direct owner",
-    });
-  const beforeCommit = prepareHostMcpOwnerAuthorization(
-    authorization,
-    workspaceId,
-    "connections:read",
-  );
-  const configs = new Map(
-    selections.map((selection) => {
-      const configured = settings.mcpServers.find((server) => server.id === selection.serverId);
-      if (
-        !configured ||
-        !tools.some((tool) => tool.kind === "mcp" && tool.id === selection.serverId) ||
-        configured.connectionRef?.authoritySource !== "host" ||
-        !configured.connectionRef.hostBinding ||
-        !configured.url
-      )
-        throw new HTTPException(422, {
-          message: "Host delegation must match a selected configured host server",
-        });
-      assertHostMcpAuthoritySourceAdmissionEnabled(settings, configured.connectionRef);
-      return [selection.serverId, structuredClone(configured)] as const;
-    }),
-  );
-  return async (tx, sessionId, turnId) => {
-    const owner = await beforeCommit(tx);
-    for (const selection of selections) {
-      const delegation = await getHostMcpDelegation(tx, owner, selection.delegationId);
-      const binding = delegation ? await getHostMcpBinding(tx, owner, delegation.bindingId) : null;
-      const configured = configs.get(selection.serverId)!;
-      if (
-        !delegation ||
-        !binding ||
-        delegation.status !== "active" ||
-        binding.status !== "active" ||
-        delegation.generation !== selection.generation ||
-        !hostMcpBindingMatchesSelection(binding, {
-          serverId: selection.serverId,
-          destinationUrl: configured.url!,
-          connectionRef: configured.connectionRef!,
-        })
-      )
-        throw new HTTPException(403, { message: "Host delegation selection changed" });
-      try {
-        await captureDirectHostMcpAuthority(tx, owner, {
-          sessionId,
-          turnId,
-          delegationId: delegation.id,
-          expectedDelegationGeneration: selection.generation,
-        });
-      } catch (error) {
-        if (error instanceof HostMcpDelegationAuthorityError)
-          throw new HTTPException(403, { message: "Host delegation authority unavailable" });
-        if (error instanceof HostMcpBindingConflictError)
-          throw new HTTPException(409, { message: "Host delegation selection conflicts" });
-        throw error;
-      }
-    }
-  };
-}
-
 function sessionPromptBoundaryRequestHash(input: {
   delivery: "send" | "steer";
   controlEtag: string | null;
@@ -3376,8 +3453,7 @@ function sessionPromptBoundaryRequestHash(input: {
   latencyMode: "standard" | "priority" | "fast" | null;
   source: "user" | "api";
   mcpCredentialUpdates: SessionMcpCredentialUpdateInput[];
-  connectionAuthorities?: McpConnectionAuthoritySelection[];
-  selectedHostMcpDelegations?: HostMcpCreateSelection[];
+  connectionAccounts?: McpConnectionAccountSelection[];
   personalResourceAttachment?: PersonalResourceAttachmentIntent;
   commandActor: SessionCommandActor;
 }): string {
@@ -3396,10 +3472,7 @@ function sessionPromptBoundaryRequestHash(input: {
     latencyMode: input.latencyMode,
     source: input.source,
     mcpCredentialUpdates: input.mcpCredentialUpdates,
-    connectionAuthorities: input.connectionAuthorities ?? [],
-    ...(input.selectedHostMcpDelegations?.length
-      ? { selectedHostMcpDelegations: input.selectedHostMcpDelegations }
-      : {}),
+    connectionAccounts: input.connectionAccounts ?? [],
     personalResourceAttachment: input.personalResourceAttachment ?? null,
     ...(input.commandActor.type === "service"
       ? {
@@ -3437,8 +3510,7 @@ async function acceptSessionUserMessageInFileScope(
     latencyMode?: "standard" | "priority" | "fast" | null;
     clientEventId?: string;
     mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
-    connectionAuthorities?: McpConnectionAuthoritySelection[];
-    selectedHostMcpDelegations?: HostMcpCreateSelection[];
+    connectionAccounts?: McpConnectionAccountSelection[];
     delivery?: "send" | "steer";
     origin?: "human" | "operator";
     controlEtag?: string | null;
@@ -3456,24 +3528,7 @@ async function acceptSessionUserMessageInFileScope(
   replay: boolean;
 }> {
   const { db, bus, workflowClient, objectStorage } = deps;
-  const hostSelections = HostMcpCreateSelections.parse(input.selectedHostMcpDelegations ?? []).sort(
-    (a, b) => (a.serverId < b.serverId ? -1 : a.serverId > b.serverId ? 1 : 0),
-  );
-  if (
-    hostSelections.length &&
-    (!input.authorization ||
-      input.authorization.grant.accountId !== grant.accountId ||
-      input.authorization.grant.subjectId !== grant.subjectId ||
-      input.authorization?.grant.workspaceId !== workspaceId ||
-      !hasPermission(input.authorization?.grant.permissions ?? [], "connections:read") ||
-      !hasPermission(grant.permissions, "connections:read") ||
-      grant.metadata?.["sessionId"])
-  )
-    throw new HTTPException(403, {
-      message: "Host selection requires a verified direct owner",
-    });
-  if (hostSelections.length)
-    prepareHostMcpOwnerAuthorization(input.authorization!, workspaceId, "connections:read");
+
   const delegatedServiceInitiator = serviceInitiatorForGrant(grant);
   const delivery = input.delivery ?? "send";
   const source = delegatedServiceInitiator || input.origin === "operator" ? "api" : "user";
@@ -3511,10 +3566,7 @@ async function acceptSessionUserMessageInFileScope(
         latencyMode: input.latencyMode ?? null,
         source,
         mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
-        selectedHostMcpDelegations: hostSelections,
-        ...(input.connectionAuthorities
-          ? { connectionAuthorities: input.connectionAuthorities }
-          : {}),
+        ...(input.connectionAccounts ? { connectionAccounts: input.connectionAccounts } : {}),
         ...(input.personalResourceAttachment
           ? { personalResourceAttachment: input.personalResourceAttachment }
           : {}),
@@ -3639,21 +3691,18 @@ async function acceptSessionUserMessageInFileScope(
         message: "object storage is not configured",
       });
     }
+    const attachmentOwnerContext = input.authorization
+      ? await fileOwnerContextForAccess({ db }, input.authorization, "sessions:control")
+      : grant.principalKind === "agent_attempt"
+        ? await fileOwnerContextForAgent({ db }, grant, "sessions:control")
+        : undefined;
     await validateFileResources(
       db,
       grant.accountId,
       workspaceId,
       grant.subjectId,
       requestedResources,
-      (input.authorization || grant.principalKind === "agent_attempt") &&
-        ((await getSessionAuthorityProjection(db, workspaceId, sessionId))?.visibility ===
-          "user_private" ||
-          existingSession.memoryScope === "user" ||
-          (await requireWorkspace(db, workspaceId)).kind === "personal")
-        ? input.authorization
-          ? await fileOwnerContextForAccess({ db }, input.authorization, "sessions:control")
-          : await fileOwnerContextForAgent({ db }, grant, "sessions:control")
-        : undefined,
+      attachmentOwnerContext,
     );
     await validateGitHubRepositorySelection(db, workspaceId, [
       ...existingSession.resources,
@@ -3675,18 +3724,22 @@ async function acceptSessionUserMessageInFileScope(
             connectionDelegationSource.turnId,
           )
         : null;
-    const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
-      db,
-      workspaceId,
-      settings,
-      inheritedPersonalConnectionDelegations
-        ? {
-            personalConnectionDelegations: inheritedPersonalConnectionDelegations,
-          }
-        : { subjectId: grant.subjectId },
+    const runtimeSettings = settingsWithSessionMcpServerMetadata(
+      await settingsWithEnabledCapabilityMcpServers(
+        db,
+        workspaceId,
+        settings,
+        inheritedPersonalConnectionDelegations
+          ? {
+              personalConnectionDelegations: inheritedPersonalConnectionDelegations,
+            }
+          : { subjectId: grant.subjectId },
+      ),
+      existingSession.mcpServers,
     );
-    const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    const { personalConnectionDelegations, mcpAccountBindings } = await freezeConnectionAccounts({
       db,
+      accountId: grant.accountId,
       workspaceId,
       settings: runtimeSettings,
       tools: existingSession.tools,
@@ -3703,16 +3756,9 @@ async function acceptSessionUserMessageInFileScope(
         existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
         (!existingSession.firstPartyMcpPermissions?.length ||
           existingSession.firstPartyMcpPermissions.includes("connections:read")),
-      ...(input.connectionAuthorities ? { authoritySelections: input.connectionAuthorities } : {}),
+      ...(input.connectionAccounts ? { authoritySelections: input.connectionAccounts } : {}),
     });
-    const captureSelectedHostAuthority = prepareSelectedHostTurnAuthority(
-      settingsWithSessionMcpServerMetadata(runtimeSettings, existingSession.mcpServers),
-      existingSession.tools,
-      grant,
-      workspaceId,
-      hostSelections,
-      input.authorization,
-    );
+
     const captureLinkedAuthority = prepareExternalLinkTurnAdmission(input.authorization);
     const { accepted, turn, draft, receipt, routing, interruptionCount, replay } =
       await postUserMessageTurn({
@@ -3735,13 +3781,12 @@ async function acceptSessionUserMessageInFileScope(
         turnExecutionPolicy,
         mcpCredentialUpdates,
         personalConnectionDelegations,
-        selectedHostMcpDelegations: hostSelections,
-        ...(captureSelectedHostAuthority || captureLinkedAuthority
+        mcpAccountBindings,
+
+        ...(captureLinkedAuthority
           ? {
-              captureTurnAuthority: async (tx: Database, turnId: string) => {
-                await captureLinkedAuthority?.(tx, sessionId, turnId);
-                await captureSelectedHostAuthority?.(tx, sessionId, turnId);
-              },
+              captureTurnAuthority: (tx: Database, turnId: string) =>
+                captureLinkedAuthority(tx, sessionId, turnId),
             }
           : {}),
         ...(input.personalResourceAttachment
@@ -3905,7 +3950,7 @@ export async function updateSessionMcpApprovalPolicy(
   });
   requirePermission(grant, "sessions:control");
 
-  const outcome: { server?: SessionMcpServerMetadata } = {};
+  const outcome: { server?: SessionMcpApprovalPolicyTarget } = {};
   const events = await appendSessionEventsWithLockedSessionUpdate(
     deps.db,
     grant.workspaceId,
@@ -3976,6 +4021,12 @@ function toolPolicyAuditSnapshot(
   return {
     mode: policy.mode,
     inheritedFromSessionId: policy.inheritedFromSessionId,
+    ...(policy.excludedMcpServerIds?.length
+      ? {
+          excludedMcpServerIds: policy.excludedMcpServerIds.slice(0, maxToolPolicyAuditRefs),
+          excludedMcpServerCount: policy.excludedMcpServerIds.length,
+        }
+      : {}),
     // IDs only: no MCP URLs, names, headers, credentials, schemas, or args.
     toolIds: [...toolRefs]
       .sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`))
@@ -3984,7 +4035,9 @@ function toolPolicyAuditSnapshot(
     toolCount: allToolRefs.length,
     firstPartyMcpTools: [...firstPartyMcpTools].sort(),
     firstPartyMcpToolCount: firstPartyMcpTools.length,
-    truncated: allToolRefs.length > toolRefs.length,
+    truncated:
+      allToolRefs.length > toolRefs.length ||
+      (policy.excludedMcpServerIds?.length ?? 0) > maxToolPolicyAuditRefs,
   };
 }
 
@@ -4028,9 +4081,31 @@ export async function updateSessionToolPolicy(
   );
   const explicitRequest = request.mode === "workspace_default" ? null : request;
   const requestedMode = explicitRequest ? "explicit" : "workspace_default";
+  const connectorOnlyEdit =
+    request.mode === "workspace_default" && request.excludedMcpServerIds !== undefined;
+  const requestedExclusions =
+    request.mode === "workspace_default" ? (request.excludedMcpServerIds ?? []) : [];
   const explicitRequestedTools = explicitRequest
     ? (() => {
-        const validatedTools = validateToolRefs(explicitRequest.tools, runtimeSettings);
+        // A disconnected stored selection remains policy truth, not executable
+        // authority. Preserve exact existing refs while validating every new or
+        // changed ref against the current runtime registry.
+        const availableIds = new Set(runtimeSettings.mcpServers.map((server) => server.id));
+        const retainedUnavailableRefs = explicitRequest.tools.filter(
+          (tool) =>
+            !availableIds.has(tool.id) &&
+            existingSession.tools.some((existing) => stableJson(existing) === stableJson(tool)),
+        );
+        const retainedIds = new Set(retainedUnavailableRefs.map((tool) => tool.id));
+        const validatedCurrentRefs = validateToolRefs(
+          explicitRequest.tools.filter((tool) => !retainedIds.has(tool.id)),
+          runtimeSettings,
+        );
+        const validatedTools = explicitRequest.tools.filter(
+          (tool) =>
+            retainedUnavailableRefs.includes(tool) ||
+            validatedCurrentRefs.some((validated) => validated.id === tool.id),
+        );
         const validatedIds = new Set(validatedTools.map((tool) => `${tool.kind}:${tool.id}`));
         const unknown = explicitRequest.tools.find(
           (tool) => !validatedIds.has(`${tool.kind}:${tool.id}`),
@@ -4100,6 +4175,9 @@ export async function updateSessionToolPolicy(
               )
             : parent.tools,
           runtimeSettings,
+        ).filter(
+          (tool) =>
+            tool.id === "opengeni" || !parent.toolPolicy.excludedMcpServerIds?.includes(tool.id),
         );
         const deploymentAllowedFirstPartyMcpTools = new Set(
           deploymentFirstPartyMcpToolPolicy.allowed,
@@ -4119,6 +4197,10 @@ export async function updateSessionToolPolicy(
           nextPolicy = {
             mode: "workspace_default",
             inheritedFromSessionId: parent.id,
+            ...defaultPolicyExclusions([
+              ...(parent.toolPolicy.excludedMcpServerIds ?? []),
+              ...requestedExclusions,
+            ]),
           };
         } else {
           nextTools = explicitRequestedTools!;
@@ -4149,41 +4231,88 @@ export async function updateSessionToolPolicy(
           requestedMode === "workspace_default"
             ? workspaceDefaultFirstPartyTools
             : explicitRequestedFirstPartyTools!;
-        nextPolicy = { mode: requestedMode, inheritedFromSessionId: null };
-        if (agentAttemptCaller) {
-          // A human or API key may widen a top-level session; a live agent
-          // attempt may only narrow relative to the session's CURRENT
-          // effective policy, in either mode. Adopting workspace defaults is a
-          // widen whenever it adds a server or tool the session does not hold.
-          const sessionTracksWorkspaceDefaults = session.toolPolicy?.mode === "workspace_default";
-          const currentEffectiveTools = withFirstPartyTools(
-            sessionTracksWorkspaceDefaults
-              ? withWorkspaceDefaultMcpTools(
-                  availableToolRefs(session.tools, runtimeSettings),
+        nextPolicy = {
+          mode: requestedMode,
+          inheritedFromSessionId: null,
+          ...(requestedMode === "workspace_default"
+            ? defaultPolicyExclusions(requestedExclusions)
+            : {}),
+        };
+      }
+      if (connectorOnlyEdit) {
+        if (session.toolPolicy.mode !== "workspace_default") {
+          throw new HTTPException(409, {
+            message: "adopt workspace defaults before editing connector exclusions",
+          });
+        }
+        // A connector switch never rewrites built-in tool choices or selected refs.
+        nextTools = session.tools;
+        nextFirstPartyMcpTools = [
+          ...(session.firstPartyMcpTools ?? deploymentFirstPartyMcpToolPolicy.default),
+        ];
+      }
+      if (!connectorOnlyEdit) {
+        nextTools = withoutExcludedMcpServers(nextTools, nextPolicy.excludedMcpServerIds);
+      }
+      if (agentAttemptCaller && !session.parentSessionId) {
+        // A human or API key may widen a top-level session; a live agent
+        // attempt may only narrow relative to the session's CURRENT
+        // effective policy, in either mode. Adopting workspace defaults is a
+        // widen whenever it adds a server or tool the session does not hold.
+        const sessionTracksWorkspaceDefaults = session.toolPolicy?.mode === "workspace_default";
+        const currentEffectiveTools = withFirstPartyTools(
+          sessionTracksWorkspaceDefaults
+            ? withWorkspaceDefaultMcpTools(
+                availableToolRefs(session.tools, runtimeSettings),
+                deps.settings,
+                runtimeSettings,
+                workspaceSessionToolDefaults,
+              )
+            : session.tools,
+          runtimeSettings,
+        );
+        const currentAllowedTools = withoutExcludedMcpServers(
+          currentEffectiveTools,
+          session.toolPolicy.excludedMcpServerIds,
+        );
+        const nextEffectiveTools =
+          nextPolicy.mode === "workspace_default"
+            ? withFirstPartyTools(
+                withWorkspaceDefaultMcpTools(
+                  availableToolRefs(nextTools, runtimeSettings),
                   deps.settings,
                   runtimeSettings,
                   workspaceSessionToolDefaults,
-                )
-              : session.tools,
-            runtimeSettings,
-          );
-          assertToolRefsSubset(
-            nextTools,
-            currentEffectiveTools,
-            "an agent may only narrow its session tool policy",
-          );
-          const currentFirstPartyCeiling = effectiveFirstPartyMcpToolCeiling(
-            session.firstPartyMcpTools,
-            deploymentFirstPartyMcpToolPolicy,
-          );
-          const widenedFirstPartyTool = nextFirstPartyMcpTools.find(
-            (tool) => !currentFirstPartyCeiling.has(tool),
-          );
-          if (widenedFirstPartyTool) {
-            throw new HTTPException(403, {
-              message: `an agent may only narrow its session OpenGeni tools: ${widenedFirstPartyTool}`,
-            });
-          }
+                ),
+                runtimeSettings,
+              )
+            : nextTools;
+        if (
+          nextPolicy.mode === "workspace_default" &&
+          (session.toolPolicy.excludedMcpServerIds ?? []).some(
+            (id) => !nextPolicy.excludedMcpServerIds?.includes(id),
+          )
+        ) {
+          throw new HTTPException(403, {
+            message: "an agent may not remove session connector exclusions",
+          });
+        }
+        assertToolRefsSubset(
+          withoutExcludedMcpServers(nextEffectiveTools, nextPolicy.excludedMcpServerIds),
+          currentAllowedTools,
+          "an agent may only narrow its session tool policy",
+        );
+        const currentFirstPartyCeiling = effectiveFirstPartyMcpToolCeiling(
+          session.firstPartyMcpTools,
+          deploymentFirstPartyMcpToolPolicy,
+        );
+        const widenedFirstPartyTool = nextFirstPartyMcpTools.find(
+          (tool) => !currentFirstPartyCeiling.has(tool),
+        );
+        if (widenedFirstPartyTool) {
+          throw new HTTPException(403, {
+            message: `an agent may only narrow its session OpenGeni tools: ${widenedFirstPartyTool}`,
+          });
         }
       }