@opengeni/db 0.13.1 → 0.14.0

package/dist/index.js

@@ -76,7 +76,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-N4WTE6SB.js";
+} from "./chunk-PQKVUWQW.js";
 import {
   migrate,
   runMigrations
@@ -119,6 +119,7 @@ import {
   RigChange as RigChangeContract,
   SessionGoal as SessionGoalContract,
   SessionSystemUpdatePayload,
+  sessionSystemUpdateBatchHistoryItem,
   HostEventExport as HostEventExportContract,
   HostEventExportBatch as HostEventExportBatchContract,
   HostExportConsumerId,
@@ -2892,14 +2893,6 @@ async function supersedeSessionCurrentDirectionInTransaction(db, input) {
     finishedAt: now,
     updatedAt: now
   }).where(eq5(sessionTurns.id, current.id));
-  await db.update(sessionSystemUpdates).set({ state: "pending", deliveredTurnId: null, deliveredAt: null }).where(
-    and5(
-      eq5(sessionSystemUpdates.workspaceId, input.workspaceId),
-      eq5(sessionSystemUpdates.sessionId, input.sessionId),
-      eq5(sessionSystemUpdates.deliveredTurnId, current.id),
-      eq5(sessionSystemUpdates.state, "delivered")
-    )
-  );
   if (current.status === "waiting_capacity") {
     await db.update(codexCapacityWaiters).set({ status: "superseded", updatedAt: now }).where(
       and5(
@@ -4186,14 +4179,14 @@ async function steerAgentSessionInTransaction(db, input) {
     controlRevision: resumed.revision,
     lastSequence: session.lastSequence
   });
-  await db.update(sessionSystemUpdates).set({ state: "superseded" }).where(
+  const supersededUpdates = await db.update(sessionSystemUpdates).set({ state: "superseded" }).where(
     and5(
       eq5(sessionSystemUpdates.workspaceId, input.workspaceId),
       eq5(sessionSystemUpdates.sessionId, input.targetSessionId),
       eq5(sessionSystemUpdates.kind, "agent_steer_instruction"),
-      inArray2(sessionSystemUpdates.state, ["pending", "deferred"])
+      eq5(sessionSystemUpdates.state, "pending")
     )
-  );
+  ).returning({ id: sessionSystemUpdates.id });
   const now = /* @__PURE__ */ new Date();
   const [update] = await db.insert(sessionSystemUpdates).values({
     accountId: input.accountId,
@@ -4252,6 +4245,22 @@ async function steerAgentSessionInTransaction(db, input) {
       },
       occurredAt: now
     },
+    ...supersededUpdates.length > 0 ? [
+      {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        sessionId: input.targetSessionId,
+        sequence: ++sequence,
+        type: "system.update.superseded",
+        payload: {
+          updateIds: supersededUpdates.map((entry) => entry.id),
+          count: supersededUpdates.length,
+          replacementUpdateId: update.id,
+          reason: "newer_agent_steer"
+        },
+        occurredAt: now
+      }
+    ] : [],
     {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
@@ -5194,11 +5203,15 @@ var REFRESH_WINDOW_MS = 6e4;
 var CONNECTION_REFRESH_TIMEOUT_MS = 1e4;
 function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
   const load = async (input) => {
+    const subjectOwned = input.connectionRef.subjectScope === "subject";
+    if (subjectOwned && !input.subjectId) {
+      return null;
+    }
     const request = {
       workspaceId: input.workspaceId,
       providerDomain: input.connectionRef.providerDomain,
-      // I1 deliberately accepts workspace-shared connections only at runtime.
-      allowSubjectOwned: false
+      allowSubjectOwned: subjectOwned,
+      ...subjectOwned ? { subjectId: input.subjectId } : {}
     };
     if (input.connectionRef.connectionId !== void 0) {
       request.connectionId = input.connectionRef.connectionId;
@@ -5206,10 +5219,12 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     if (input.connectionRef.kind !== void 0) {
       request.kind = input.connectionRef.kind;
     }
-    if (input.subjectId !== void 0) {
-      request.subjectId = input.subjectId;
+    const credential = await deps.loadCredential(db, settings, request);
+    if (!credential) return null;
+    if (subjectOwned) {
+      return credential.subjectId === input.subjectId ? credential : null;
     }
-    return deps.loadCredential(db, settings, request);
+    return credential.subjectId === null ? credential : null;
   };
   const snapshot = async (cred, ref, destinationUrl) => {
     if (cred.status !== "active") {
@@ -5244,7 +5259,7 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
         ...ref.selectedResources ? { selectedResources: copySelectedResources(ref.selectedResources) } : {}
       };
     }
-    await deps.recordUsed(db, cred.workspaceId, cred.id);
+    await deps.recordUsed(db, cred.workspaceId, cred.id, cred.subjectId);
     return {
       status: "ok",
       headers,
@@ -5264,7 +5279,8 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
       workspaceId: cred.workspaceId,
       credentialEncrypted: deps.encrypt(key, JSON.stringify(refreshed.credential)),
       expiresAt: refreshed.expiresAt,
-      lastRefreshAt: deps.now()
+      lastRefreshAt: deps.now(),
+      subjectId: cred.subjectId
     };
     if (refreshed.grantedScopes !== void 0) {
       refreshRecord.grantedScopes = refreshed.grantedScopes;
@@ -5273,7 +5289,8 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     if (persisted) {
       const current = await load({
         workspaceId: cred.workspaceId,
-        connectionRef: { ...ref, connectionId: cred.id }
+        connectionRef: { ...ref, connectionId: cred.id },
+        ...cred.subjectId ? { subjectId: cred.subjectId } : {}
       });
       if (current) {
         return current;
@@ -5281,7 +5298,8 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     }
     const winner = await load({
       workspaceId: cred.workspaceId,
-      connectionRef: { ...ref, connectionId: cred.id }
+      connectionRef: { ...ref, connectionId: cred.id },
+      ...cred.subjectId ? { subjectId: cred.subjectId } : {}
     });
     if (winner?.status === "active") {
       return winner;
@@ -5289,7 +5307,7 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     throw new Error("connection credential changed during token refresh");
   };
   const refreshSingleFlight = (cred, ref) => {
-    const key = `${cred.id}:${cred.version}`;
+    const key = `${cred.subjectId ?? "workspace"}:${cred.id}:${cred.version}`;
     const existing = inflight2.get(key);
     if (existing) {
       return existing;
@@ -5334,7 +5352,8 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
             error instanceof Error ? error.message : String(error),
             {
               id: cred.id,
-              version: cred.version
+              version: cred.version,
+              subjectId: cred.subjectId
             }
           ).catch(() => void 0);
         }
@@ -6151,6 +6170,17 @@ async function bootstrapWorkspace(db, input) {
         updatedAt: /* @__PURE__ */ new Date()
       }).where(eq7(workspaceMemberships.id, membership.id));
     }
+    await setRlsContext(tx, {
+      accountId: workspace.accountId,
+      workspaceId: null
+    });
+    const memberships = await tx.select({
+      membership: workspaceMemberships,
+      workspace: workspaces
+    }).from(workspaceMemberships).innerJoin(
+      workspaces,
+      eq7(workspaceMemberships.workspaceId, workspaces.id)
+    ).where(eq7(workspaceMemberships.subjectId, input.subjectId)).orderBy(desc2(workspaces.createdAt));
     return {
       mode: input.accountExternalSource === "opengeni:local" ? "local" : "configured",
       subjectId: input.subjectId,
@@ -6164,15 +6194,13 @@ async function bootstrapWorkspace(db, input) {
           permissions: input.accountPermissions ?? allAccountPermissions
         }
       ],
-      workspaceGrants: [
-        {
-          workspaceId: workspace.id,
-          accountId: account.id,
-          subjectId: input.subjectId,
-          ...input.subjectLabel ? { subjectLabel: input.subjectLabel } : {},
-          permissions: workspacePermissions
-        }
-      ],
+      workspaceGrants: memberships.map((row) => ({
+        workspaceId: row.workspace.id,
+        accountId: row.workspace.accountId,
+        subjectId: input.subjectId,
+        ...input.subjectLabel ? { subjectLabel: input.subjectLabel } : {},
+        permissions: row.membership.permissions
+      })),
       defaultAccountId: account.id,
       defaultWorkspaceId: workspace.id
     };
@@ -8032,36 +8060,48 @@ var connectionMetadataColumns = {
 function connectionSubjectVisibility(subjectId) {
   return subjectId ? or(isNull2(connections.subjectId), eq7(connections.subjectId, subjectId)) : isNull2(connections.subjectId);
 }
+function connectionExactSubject(subjectId) {
+  return subjectId ? eq7(connections.subjectId, subjectId) : isNull2(connections.subjectId);
+}
+async function withConnectionSubjectRls(db, workspaceId, subjectId, fn) {
+  return subjectId ? await withWorkspaceSubjectRls(db, workspaceId, subjectId, fn) : await withWorkspaceRls(db, workspaceId, fn);
+}
+async function createConnectionInScope(db, input) {
+  const [row] = await db.insert(connections).values({
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: input.subjectId ?? null,
+    providerDomain: input.providerDomain,
+    kind: input.kind,
+    status: input.status ?? "active",
+    credentialEncrypted: input.credentialEncrypted,
+    grantedScopes: input.grantedScopes ?? [],
+    expiresAt: input.expiresAt ?? null,
+    verifiedInstallAt: input.verifiedInstallAt ?? null,
+    verifiedInstallVersion: input.verifiedInstallVersion ?? null,
+    metadata: input.metadata ?? {},
+    createdBySubjectId: input.createdBySubjectId ?? null,
+    updatedBySubjectId: input.updatedBySubjectId ?? input.createdBySubjectId ?? null
+  }).returning(connectionMetadataColumns);
+  if (!row) {
+    throw new Error("Failed to create connection");
+  }
+  return mapConnectionMetadata(row);
+}
 async function createConnection(db, input) {
   return await withRlsContext(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const [row] = await scopedDb.insert(connections).values({
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        subjectId: input.subjectId ?? null,
-        providerDomain: input.providerDomain,
-        kind: input.kind,
-        status: input.status ?? "active",
-        credentialEncrypted: input.credentialEncrypted,
-        grantedScopes: input.grantedScopes ?? [],
-        expiresAt: input.expiresAt ?? null,
-        verifiedInstallAt: input.verifiedInstallAt ?? null,
-        verifiedInstallVersion: input.verifiedInstallVersion ?? null,
-        metadata: input.metadata ?? {},
-        createdBySubjectId: input.createdBySubjectId ?? null,
-        updatedBySubjectId: input.updatedBySubjectId ?? input.createdBySubjectId ?? null
-      }).returning(connectionMetadataColumns);
-      if (!row) {
-        throw new Error("Failed to create connection");
+      if (input.subjectId) {
+        await setSubjectRlsContext(scopedDb, input.subjectId);
       }
-      return mapConnectionMetadata(row);
+      return await createConnectionInScope(scopedDb, input);
     }
   );
 }
 async function listConnectionsMetadata(db, workspaceId, subjectId) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const rows = await scopedDb.select(connectionMetadataColumns).from(connections).where(
       and7(
         eq7(connections.workspaceId, workspaceId),
@@ -8072,7 +8112,7 @@ async function listConnectionsMetadata(db, workspaceId, subjectId) {
   });
 }
 async function getConnectionMetadata(db, workspaceId, connectionId, subjectId) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const [row] = await scopedDb.select(connectionMetadataColumns).from(connections).where(
       and7(
         eq7(connections.workspaceId, workspaceId),
@@ -8083,66 +8123,217 @@ async function getConnectionMetadata(db, workspaceId, connectionId, subjectId) {
     return row ? mapConnectionMetadata(row) : null;
   });
 }
+async function updateConnectionInScope(db, input) {
+  const set = {
+    updatedAt: /* @__PURE__ */ new Date(),
+    ...input.providerDomain !== void 0 ? { providerDomain: input.providerDomain } : {},
+    ...input.subjectId !== void 0 ? { subjectId: input.subjectId } : {},
+    ...input.kind !== void 0 ? { kind: input.kind } : {},
+    ...input.status !== void 0 ? { status: input.status } : {},
+    ...input.credentialEncrypted !== void 0 ? {
+      credentialEncrypted: input.credentialEncrypted,
+      version: sql4`${connections.version} + 1`,
+      lastError: null
+    } : {},
+    ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {},
+    ...input.expiresAt !== void 0 ? { expiresAt: input.expiresAt } : {},
+    ...input.verifiedInstallAt !== void 0 ? { verifiedInstallAt: input.verifiedInstallAt } : {},
+    ...input.verifiedInstallVersion !== void 0 ? { verifiedInstallVersion: input.verifiedInstallVersion } : {},
+    ...input.metadata !== void 0 ? { metadata: input.metadata } : {},
+    ...input.updatedBySubjectId !== void 0 ? { updatedBySubjectId: input.updatedBySubjectId } : {}
+  };
+  const [row] = await db.update(connections).set(set).where(
+    and7(
+      eq7(connections.workspaceId, input.workspaceId),
+      eq7(connections.id, input.connectionId),
+      connectionSubjectVisibility(input.visibleToSubjectId),
+      ...input.expectedVersion !== void 0 ? [eq7(connections.version, input.expectedVersion)] : []
+    )
+  ).returning(connectionMetadataColumns);
+  return row ? mapConnectionMetadata(row) : null;
+}
 async function updateConnection(db, input) {
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const set = {
-      updatedAt: /* @__PURE__ */ new Date(),
-      ...input.providerDomain !== void 0 ? { providerDomain: input.providerDomain } : {},
-      ...input.subjectId !== void 0 ? { subjectId: input.subjectId } : {},
-      ...input.kind !== void 0 ? { kind: input.kind } : {},
-      ...input.status !== void 0 ? { status: input.status } : {},
-      ...input.credentialEncrypted !== void 0 ? {
-        credentialEncrypted: input.credentialEncrypted,
-        version: sql4`${connections.version} + 1`,
-        lastError: null
-      } : {},
-      ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {},
-      ...input.expiresAt !== void 0 ? { expiresAt: input.expiresAt } : {},
-      ...input.verifiedInstallAt !== void 0 ? { verifiedInstallAt: input.verifiedInstallAt } : {},
-      ...input.verifiedInstallVersion !== void 0 ? { verifiedInstallVersion: input.verifiedInstallVersion } : {},
-      ...input.metadata !== void 0 ? { metadata: input.metadata } : {},
-      ...input.updatedBySubjectId !== void 0 ? { updatedBySubjectId: input.updatedBySubjectId } : {}
-    };
-    const [row] = await scopedDb.update(connections).set(set).where(
-      and7(
-        eq7(connections.workspaceId, input.workspaceId),
-        eq7(connections.id, input.connectionId),
-        connectionSubjectVisibility(input.visibleToSubjectId),
-        ...input.expectedVersion !== void 0 ? [eq7(connections.version, input.expectedVersion)] : []
-      )
-    ).returning(connectionMetadataColumns);
-    return row ? mapConnectionMetadata(row) : null;
-  });
+  return await withConnectionSubjectRls(
+    db,
+    input.workspaceId,
+    input.visibleToSubjectId,
+    async (scopedDb) => await updateConnectionInScope(scopedDb, input)
+  );
+}
+async function revokeConnectionInScope(db, workspaceId, connectionId, updatedBySubjectId, expectedVersion) {
+  const [row] = await db.update(connections).set({
+    status: "revoked",
+    // The version bump invalidates any in-flight refresh's (id, version) CAS,
+    // so a racing refresh cannot commit and flip the row back to active.
+    version: sql4`${connections.version} + 1`,
+    // Status-only revocation does not replace the verified credential or bot
+    // identity. Carry the marker to the same new CAS version so the dedicated
+    // reinstall path can still recognize (but not use) the inactive row.
+    verifiedInstallVersion: sql4`case
+        when ${connections.verifiedInstallAt} is null then null
+        else ${connections.version} + 1
+      end`,
+    updatedBySubjectId: updatedBySubjectId ?? null,
+    updatedAt: /* @__PURE__ */ new Date()
+  }).where(
+    and7(
+      eq7(connections.workspaceId, workspaceId),
+      eq7(connections.id, connectionId),
+      // Same visibility rule as get/update: shared rows plus the caller's own
+      // subject rows. Cross-subject revocation (admin janitorial) arrives with
+      // the subject-connections UX in I5, deliberately not before.
+      connectionSubjectVisibility(updatedBySubjectId),
+      ...expectedVersion !== void 0 ? [eq7(connections.version, expectedVersion)] : []
+    )
+  ).returning(connectionMetadataColumns);
+  return row ? mapConnectionMetadata(row) : null;
 }
 async function revokeConnection(db, workspaceId, connectionId, updatedBySubjectId) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb.update(connections).set({
-      status: "revoked",
-      // The version bump invalidates any in-flight refresh's (id, version) CAS,
-      // so a racing refresh cannot commit and flip the row back to active.
-      version: sql4`${connections.version} + 1`,
-      // Status-only revocation does not replace the verified credential or bot
-      // identity. Carry the marker to the same new CAS version so the dedicated
-      // reinstall path can still recognize (but not use) the inactive row.
-      verifiedInstallVersion: sql4`case
-          when ${connections.verifiedInstallAt} is null then null
-          else ${connections.version} + 1
-        end`,
-      updatedBySubjectId: updatedBySubjectId ?? null,
-      updatedAt: /* @__PURE__ */ new Date()
-    }).where(
-      and7(
-        eq7(connections.workspaceId, workspaceId),
-        eq7(connections.id, connectionId),
-        // Same visibility rule as get/update: shared rows plus the caller's own
-        // subject rows. Cross-subject revocation (admin janitorial) arrives with
-        // the subject-connections UX in I5, deliberately not before.
-        connectionSubjectVisibility(updatedBySubjectId)
-      )
-    ).returning(connectionMetadataColumns);
-    return row ? mapConnectionMetadata(row) : null;
+  return await withConnectionSubjectRls(
+    db,
+    workspaceId,
+    updatedBySubjectId,
+    async (scopedDb) => await revokeConnectionInScope(scopedDb, workspaceId, connectionId, updatedBySubjectId)
+  );
+}
+var SlackBotLifecycleSuccessAuditError = class extends Error {
+  constructor() {
+    super("OpenGeni Slack bot lifecycle success audit failed");
+    this.name = "SlackBotLifecycleSuccessAuditError";
+  }
+};
+async function insertSlackBotLifecycleSuccessAuditInScope(db, input) {
+  try {
+    await db.insert(auditEvents).values({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      action: input.action,
+      targetType: "connection",
+      targetId: input.connectionId,
+      metadata: {
+        credentialRole: input.credentialRole,
+        credentialLabel: input.credentialLabel,
+        connectionId: input.connectionId,
+        slackTeamId: input.slackTeamId,
+        outcome: "succeeded"
+      }
+    });
+  } catch {
+    throw new SlackBotLifecycleSuccessAuditError();
+  }
+}
+async function assertWorkspaceAccountPairInScope(db, accountId, workspaceId) {
+  const [workspace] = await db.select({ id: workspaces.id }).from(workspaces).where(and7(eq7(workspaces.id, workspaceId), eq7(workspaces.accountId, accountId))).limit(1);
+  if (!workspace) {
+    throw new Error("Workspace does not belong to the expected account");
+  }
+}
+async function withSlackBotLifecycleRls(db, input, fn) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      await setSubjectRlsContext(scopedDb, input.subjectId);
+      await assertWorkspaceAccountPairInScope(scopedDb, input.accountId, input.workspaceId);
+      return await fn(scopedDb);
+    }
+  );
+}
+async function createConnectionWithSlackBotSuccessAudit(db, input) {
+  if (input.connection.accountId !== input.accountId || input.connection.workspaceId !== input.workspaceId) {
+    throw new Error("Slack bot connection and lifecycle audit tenant must match");
+  }
+  return await withSlackBotLifecycleRls(db, input, async (scopedDb) => {
+    const connection = await createConnectionInScope(scopedDb, input.connection);
+    await insertSlackBotLifecycleSuccessAuditInScope(scopedDb, {
+      ...input,
+      action: "slack_bot.connected",
+      connectionId: connection.id
+    });
+    return connection;
   });
 }
+async function updateConnectionWithSlackBotSuccessAudit(db, input) {
+  if (input.connection.workspaceId !== input.workspaceId) {
+    throw new Error("Slack bot connection and lifecycle audit workspace must match");
+  }
+  return await withSlackBotLifecycleRls(db, input, async (scopedDb) => {
+    const connection = await updateConnectionInScope(scopedDb, input.connection);
+    if (!connection) return null;
+    if (connection.accountId !== input.accountId) {
+      throw new Error("Slack bot connection and lifecycle audit account must match");
+    }
+    await insertSlackBotLifecycleSuccessAuditInScope(scopedDb, {
+      ...input,
+      action: "slack_bot.reinstalled",
+      connectionId: connection.id
+    });
+    return connection;
+  });
+}
+async function revokeConnectionWithSlackBotSuccessAudit(db, input) {
+  return await withSlackBotLifecycleRls(db, input, async (scopedDb) => {
+    const connection = await revokeConnectionInScope(
+      scopedDb,
+      input.workspaceId,
+      input.connectionId,
+      input.subjectId,
+      input.expectedVersion
+    );
+    if (!connection) return null;
+    if (connection.accountId !== input.accountId) {
+      throw new Error("Slack bot connection and lifecycle audit account must match");
+    }
+    await insertSlackBotLifecycleSuccessAuditInScope(scopedDb, {
+      ...input,
+      action: "slack_bot.disconnected",
+      connectionId: connection.id
+    });
+    return connection;
+  });
+}
+async function recordSlackBotInstallCallbackFailure(db, input) {
+  if (!/^[a-f0-9]{64}$/.test(input.callbackDigest)) {
+    throw new Error("Slack callback digest must be a lowercase SHA-256 value");
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      await setSubjectRlsContext(scopedDb, input.subjectId);
+      await assertWorkspaceAccountPairInScope(scopedDb, input.accountId, input.workspaceId);
+      await scopedDb.execute(
+        sql4`select pg_advisory_xact_lock(hashtextextended(${`slack-callback-failure:${input.workspaceId}:${input.callbackDigest}`}, 0))`
+      );
+      const [existing] = await scopedDb.select({ id: auditEvents.id }).from(auditEvents).where(
+        and7(
+          eq7(auditEvents.accountId, input.accountId),
+          eq7(auditEvents.workspaceId, input.workspaceId),
+          eq7(auditEvents.action, "slack_bot.install.callback.failed"),
+          eq7(auditEvents.targetType, "slack_oauth_callback"),
+          eq7(auditEvents.targetId, input.callbackDigest)
+        )
+      ).limit(1);
+      if (existing) return false;
+      await scopedDb.insert(auditEvents).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.subjectId,
+        action: "slack_bot.install.callback.failed",
+        targetType: "slack_oauth_callback",
+        targetId: input.callbackDigest,
+        metadata: {
+          outcome: "failed",
+          installMode: input.installMode,
+          stage: input.stage,
+          reason: input.reason
+        }
+      });
+      return true;
+    }
+  );
+}
 async function claimSlackBotPostOperation(db, input) {
   const claimLeaseMs = Math.max(1, Math.min(Math.trunc(input.claimLeaseMs), 12e4));
   return await withRlsContext(
@@ -8302,13 +8493,16 @@ async function getSlackBotPostOperation(db, workspaceId, connectionId, operation
   });
 }
 async function loadConnectionCredentialForBroker(db, settings, input) {
+  if (input.allowSubjectOwned && !input.subjectId) {
+    return null;
+  }
   const key = environmentsEncryptionKeyBytes3(settings);
   if (!key) {
     throw new Error(
       "connection credential present but OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured"
     );
   }
-  const subjectPredicate = input.allowSubjectOwned ? connectionSubjectVisibility(input.subjectId) : isNull2(connections.subjectId);
+  const subjectPredicate = input.allowSubjectOwned ? connectionExactSubject(input.subjectId) : isNull2(connections.subjectId);
   const conditions = [
     eq7(connections.workspaceId, input.workspaceId),
     subjectPredicate
@@ -8321,70 +8515,81 @@ async function loadConnectionCredentialForBroker(db, settings, input) {
       conditions.push(eq7(connections.kind, input.kind));
     }
   }
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb.select().from(connections).where(and7(...conditions)).orderBy(
-      desc2(sql4`(${connections.status} = 'active')`),
-      desc2(connections.updatedAt)
-    ).limit(1);
-    if (!row) {
-      return null;
-    }
-    let credential;
-    try {
-      credential = JSON.parse(decryptEnvironmentValue(key, row.credentialEncrypted));
-    } catch (error) {
-      throw new Error(
-        `connection credential could not be decrypted for ${row.id}: ${error instanceof Error ? error.message : String(error)}`,
-        { cause: error }
-      );
-    }
-    if (!credential || typeof credential !== "object" || Array.isArray(credential)) {
-      throw new Error(`connection credential bundle for ${row.id} is not a JSON object`);
+  return await withConnectionSubjectRls(
+    db,
+    input.workspaceId,
+    input.allowSubjectOwned ? input.subjectId : null,
+    async (scopedDb) => {
+      const [row] = await scopedDb.select().from(connections).where(and7(...conditions)).orderBy(
+        desc2(sql4`(${connections.status} = 'active')`),
+        desc2(connections.updatedAt)
+      ).limit(1);
+      if (!row) {
+        return null;
+      }
+      let credential;
+      try {
+        credential = JSON.parse(decryptEnvironmentValue(key, row.credentialEncrypted));
+      } catch (error) {
+        throw new Error(
+          `connection credential could not be decrypted for ${row.id}: ${error instanceof Error ? error.message : String(error)}`,
+          { cause: error }
+        );
+      }
+      if (!credential || typeof credential !== "object" || Array.isArray(credential)) {
+        throw new Error(`connection credential bundle for ${row.id} is not a JSON object`);
+      }
+      return {
+        id: row.id,
+        accountId: row.accountId,
+        workspaceId: row.workspaceId,
+        subjectId: row.subjectId,
+        providerDomain: row.providerDomain,
+        kind: row.kind,
+        status: row.status,
+        credential,
+        grantedScopes: row.grantedScopes,
+        expiresAt: row.expiresAt,
+        lastRefreshAt: row.lastRefreshAt,
+        version: row.version,
+        metadata: row.metadata
+      };
     }
-    return {
-      id: row.id,
-      accountId: row.accountId,
-      workspaceId: row.workspaceId,
-      subjectId: row.subjectId,
-      providerDomain: row.providerDomain,
-      kind: row.kind,
-      status: row.status,
-      credential,
-      grantedScopes: row.grantedScopes,
-      expiresAt: row.expiresAt,
-      lastRefreshAt: row.lastRefreshAt,
-      version: row.version,
-      metadata: row.metadata
-    };
-  });
+  );
 }
 async function recordConnectionTokenRefresh(db, input) {
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const set = {
-      credentialEncrypted: input.credentialEncrypted,
-      expiresAt: input.expiresAt,
-      lastRefreshAt: input.lastRefreshAt,
-      status: "active",
-      lastError: null,
-      version: sql4`${connections.version} + 1`,
-      updatedAt: /* @__PURE__ */ new Date(),
-      ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {}
-    };
-    const updated = await scopedDb.update(connections).set(set).where(
-      and7(
-        eq7(connections.id, input.id),
-        eq7(connections.workspaceId, input.workspaceId),
-        eq7(connections.version, input.version),
-        // A refresh may only ever renew a live credential; revoked/errored rows
-        // stay dead even if a status change somewhere forgot to bump version.
-        eq7(connections.status, "active")
-      )
-    ).returning({ id: connections.id });
-    return updated.length > 0;
-  });
+  return await withConnectionSubjectRls(
+    db,
+    input.workspaceId,
+    input.subjectId,
+    async (scopedDb) => {
+      const set = {
+        credentialEncrypted: input.credentialEncrypted,
+        expiresAt: input.expiresAt,
+        lastRefreshAt: input.lastRefreshAt,
+        status: "active",
+        lastError: null,
+        version: sql4`${connections.version} + 1`,
+        updatedAt: /* @__PURE__ */ new Date(),
+        ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {}
+      };
+      const updated = await scopedDb.update(connections).set(set).where(
+        and7(
+          eq7(connections.id, input.id),
+          eq7(connections.workspaceId, input.workspaceId),
+          eq7(connections.version, input.version),
+          connectionExactSubject(input.subjectId),
+          // A refresh may only ever renew a live credential; revoked/errored rows
+          // stay dead even if a status change somewhere forgot to bump version.
+          eq7(connections.status, "active")
+        )
+      ).returning({ id: connections.id });
+      return updated.length > 0;
+    }
+  );
 }
 async function setConnectionStatus(db, workspaceId, status, lastError, guard) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withConnectionSubjectRls(db, workspaceId, guard.subjectId, async (scopedDb) => {
     const updated = await scopedDb.update(connections).set({
       status,
       lastError,
@@ -8398,21 +8603,23 @@ async function setConnectionStatus(db, workspaceId, status, lastError, guard) {
       and7(
         eq7(connections.workspaceId, workspaceId),
         eq7(connections.id, guard.id),
-        eq7(connections.version, guard.version)
+        eq7(connections.version, guard.version),
+        connectionExactSubject(guard.subjectId)
       )
     ).returning({ id: connections.id });
     return updated.length > 0;
   });
 }
-async function recordConnectionUsed(db, workspaceId, connectionId) {
-  await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+async function recordConnectionUsed(db, workspaceId, connectionId, subjectId) {
+  await withConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     await scopedDb.update(connections).set({
       lastUsedAt: /* @__PURE__ */ new Date(),
       updatedAt: /* @__PURE__ */ new Date()
     }).where(
       and7(
         eq7(connections.workspaceId, workspaceId),
-        eq7(connections.id, connectionId)
+        eq7(connections.id, connectionId),
+        connectionExactSubject(subjectId)
       )
     );
   });
@@ -13536,6 +13743,7 @@ async function createSessionInTransaction(tx, input, id) {
     initialMessage: input.initialMessage,
     initialTurnInstructions: input.initialTurnInstructions ?? null,
     resources: input.resources,
+    skills: input.skills ?? [],
     tools: input.tools ?? [],
     toolPolicy: input.toolPolicy ?? null,
     metadata: input.metadata,
@@ -13548,6 +13756,7 @@ async function createSessionInTransaction(tx, input, id) {
     rigId: input.rigId ?? null,
     rigVersionId: input.rigVersionId ?? null,
     firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+    firstPartyMcpTools: input.firstPartyMcpTools ?? null,
     instructions: input.instructions ?? null,
     parentSessionId: input.parentSessionId ?? null,
     createIdempotencyKey,
@@ -14852,25 +15061,34 @@ async function getSessionLineage(db, workspaceId, sessionId) {
     if (rootRows.length === 0) {
       return null;
     }
-    const ancestorRows = await scopedDb.execute(sql4`
-      with recursive ancestors(id, parent_session_id, depth, path) as (
-        select ${sessions.id}, ${sessions.parentSessionId}, 0, array[${sessions.id}]
+    const ancestorLineageRows = await scopedDb.execute(sql4`
+      with recursive ancestors(id, parent_session_id, depth, path, cycle) as (
+        select ${sessions.id}, ${sessions.parentSessionId}, 0, array[${sessions.id}], false
         from ${sessions}
         where ${sessions.workspaceId} = ${workspaceId}
           and ${sessions.id} = ${sessionId}
         union all
-        select parent.id, parent.parent_session_id, ancestors.depth + 1, ancestors.path || parent.id
+        select
+          parent.id,
+          parent.parent_session_id,
+          ancestors.depth + 1,
+          ancestors.path || parent.id,
+          parent.id = any(ancestors.path)
         from ${sessions} parent
         join ancestors on ancestors.parent_session_id = parent.id
         where parent.workspace_id = ${workspaceId}
-          and ancestors.depth < 10
-          and not parent.id = any(ancestors.path)
+          and not ancestors.cycle
+          and ancestors.depth < 64
       )
-      select id, parent_session_id as "parentSessionId", depth, path
+      select id, parent_session_id as "parentSessionId", depth, path, cycle
       from ancestors
-      where depth > 0
       order by depth desc
     `);
+    const frontier = ancestorLineageRows[0];
+    if (!frontier || frontier.cycle || frontier.parentSessionId !== null || Number(frontier.depth) >= 64) {
+      throw new Error(`session lineage for ${sessionId} has no valid workspace root`);
+    }
+    const ancestorRows = ancestorLineageRows.filter((row) => row.depth > 0);
     const childRows = await scopedDb.execute(sql4`
       with recursive descendants(id, parent_session_id, depth, path) as (
         select child.id, child.parent_session_id, 1, array[${sessionId}, child.id]
@@ -14885,7 +15103,7 @@ async function getSessionLineage(db, workspaceId, sessionId) {
           and descendants.depth < 5
           and not child.id = any(descendants.path)
       )
-      select id, parent_session_id as "parentSessionId", depth, path
+      select id, parent_session_id as "parentSessionId", depth, path, false as cycle
       from descendants
       order by path
       limit ${descendantLimit + 1}
@@ -22005,7 +22223,7 @@ async function materializeGoalContinuation(db, input) {
           eq7(sessionSystemUpdates.workspaceId, input.workspaceId),
           eq7(sessionSystemUpdates.sessionId, input.sessionId),
           eq7(sessionSystemUpdates.kind, "agent_steer_instruction"),
-          inArray3(sessionSystemUpdates.state, ["pending", "deferred"])
+          eq7(sessionSystemUpdates.state, "pending")
         )
       ).limit(1);
       if (pendingSteer) {
@@ -22128,6 +22346,7 @@ async function materializeGoalContinuation(db, input) {
         idempotencyKey: `agent_run.created:goal:${input.workspaceId}:${decision.goal.id}:${goalWakeRevision}`,
         occurredAt: now
       }).onConflictDoNothing({ target: usageEvents.idempotencyKey });
+      const eventPreview = internalUpdateEventMember(update);
       const insertedEvents = await tx.insert(sessionEvents).values([
         {
           accountId: session.accountId,
@@ -22136,11 +22355,13 @@ async function materializeGoalContinuation(db, input) {
           sequence: session.lastSequence + 1,
           type: "system.update.pending",
           payload: sanitizeEventPayload({
-            updateId: update.id,
-            kind: update.kind,
-            classification: update.classification,
-            sourceId: update.sourceId,
-            summary: update.summary
+            updateId: eventPreview.id,
+            kind: eventPreview.kind,
+            classification: eventPreview.classification,
+            sourceId: eventPreview.sourceId,
+            sourceIdTruncated: eventPreview.sourceIdTruncated,
+            summary: eventPreview.summary,
+            summaryTruncated: eventPreview.summaryTruncated
           }),
           occurredAt: now
         },
@@ -22521,6 +22742,62 @@ async function enqueueSessionTurn(db, input) {
 var MAX_INTERNAL_UPDATE_BYTES = 64 * 1024;
 var MAX_INTERNAL_UPDATE_BATCH_MEMBERS = 100;
 var MAX_INTERNAL_UPDATE_BATCH_BYTES = 256 * 1024;
+var MAX_INTERNAL_UPDATE_EVENT_SUMMARY_BYTES = 512;
+var MAX_INTERNAL_UPDATE_EVENT_SOURCE_BYTES = 256;
+function boundedInternalUpdateEventText(value, maxBytes) {
+  if (Buffer.byteLength(value) <= maxBytes) return { text: value, truncated: false };
+  const suffix = "\u2026";
+  const bodyBudget = maxBytes - Buffer.byteLength(suffix);
+  const bytes = Buffer.from(value);
+  let text = bytes.subarray(0, bodyBudget).toString("utf8");
+  if (text.endsWith("\uFFFD")) text = text.slice(0, -1);
+  return { text: `${text}${suffix}`, truncated: true };
+}
+function internalUpdateEventMember(update) {
+  const summary = boundedInternalUpdateEventText(
+    update.summary,
+    MAX_INTERNAL_UPDATE_EVENT_SUMMARY_BYTES
+  );
+  const source = boundedInternalUpdateEventText(
+    update.sourceId,
+    MAX_INTERNAL_UPDATE_EVENT_SOURCE_BYTES
+  );
+  return {
+    id: update.id,
+    kind: update.kind,
+    classification: update.classification,
+    sourceId: source.text,
+    sourceIdTruncated: source.truncated,
+    summary: summary.text,
+    summaryTruncated: summary.truncated
+  };
+}
+function selectBoundedSystemUpdateBatch(updates) {
+  const selected = [];
+  let selectedBytes = 0;
+  for (const update of updates) {
+    const updateBytes = Buffer.byteLength(
+      JSON.stringify({
+        id: update.id,
+        kind: update.kind,
+        classification: update.classification,
+        sourceId: update.sourceId,
+        summary: update.summary,
+        payload: update.payload,
+        lineage: update.lineage
+      })
+    );
+    if (selected.length >= MAX_INTERNAL_UPDATE_BATCH_MEMBERS || // One individually large canonical input must still make progress. The
+    // model/context boundary may reject it explicitly, but the queue cannot
+    // wedge forever merely because the coalescing target is smaller.
+    selected.length > 0 && selectedBytes + updateBytes > MAX_INTERNAL_UPDATE_BATCH_BYTES) {
+      break;
+    }
+    selected.push(update);
+    selectedBytes += updateBytes;
+  }
+  return selected;
+}
 async function claimSessionWorkForAttempt(db, workspaceId, input) {
   const { sessionId, workflowId } = input;
   return await withWorkspaceRls(
@@ -22532,29 +22809,18 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           and7(
             eq7(sessionSystemUpdates.workspaceId, workspaceId),
             eq7(sessionSystemUpdates.sessionId, sessionId),
-            inArray3(sessionSystemUpdates.state, ["pending", "deferred"]),
+            eq7(sessionSystemUpdates.state, "pending"),
             eq7(sessionSystemUpdates.kind, "agent_steer_instruction")
           )
         ).orderBy(
           desc2(sessionSystemUpdates.createdAt),
           desc2(sessionSystemUpdates.id)
         ).limit(1).for("update");
-        if (agentSteer) {
-          await tx.update(sessionSystemUpdates).set({ state: "superseded" }).where(
-            and7(
-              eq7(sessionSystemUpdates.workspaceId, workspaceId),
-              eq7(sessionSystemUpdates.sessionId, sessionId),
-              eq7(sessionSystemUpdates.kind, "agent_steer_instruction"),
-              inArray3(sessionSystemUpdates.state, ["pending", "deferred"]),
-              ne(sessionSystemUpdates.id, agentSteer.id)
-            )
-          );
-        }
         const ordinary = await tx.select().from(sessionSystemUpdates).where(
           and7(
             eq7(sessionSystemUpdates.workspaceId, workspaceId),
             eq7(sessionSystemUpdates.sessionId, sessionId),
-            inArray3(sessionSystemUpdates.state, ["pending", "deferred"]),
+            eq7(sessionSystemUpdates.state, "pending"),
             ne(sessionSystemUpdates.kind, "agent_steer_instruction")
           )
         ).orderBy(
@@ -22567,12 +22833,15 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
             count: 0,
             lastSequence: nextSequence - 1,
             triggerEventId: null,
+            historyItemId: null,
+            historyItem: null,
             updates: [],
+            events: [],
             event: null
           };
         }
-        const deliverable = [];
-        let deliveredBytes = 0;
+        const validUpdates = [];
+        const cancelledUpdateIds = [];
         for (const update of updates) {
           const payload = update.payload;
           if (payload.type === "goal_continuation") {
@@ -22590,38 +22859,56 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
             ).for("update").limit(1) : [];
             if (!goal || goal.status !== "active" || goal.version !== goalVersion) {
               await tx.update(sessionSystemUpdates).set({ state: "cancelled" }).where(eq7(sessionSystemUpdates.id, update.id));
+              cancelledUpdateIds.push(update.id);
               continue;
             }
           }
-          const updateBytes = Buffer.byteLength(
-            JSON.stringify({
-              id: update.id,
-              kind: update.kind,
-              classification: update.classification,
-              sourceId: update.sourceId,
-              summary: update.summary,
-              payload: update.payload,
-              lineage: update.lineage
-            })
-          );
-          if (deliverable.length >= MAX_INTERNAL_UPDATE_BATCH_MEMBERS || deliveredBytes + updateBytes > MAX_INTERNAL_UPDATE_BATCH_BYTES) {
-            break;
-          }
-          deliverable.push(update);
-          deliveredBytes += updateBytes;
+          validUpdates.push(update);
         }
+        const deliverable = selectBoundedSystemUpdateBatch(validUpdates);
         if (deliverable.length === 0) {
+          const cancellationEvent = cancelledUpdateIds.length > 0 ? {
+            accountId,
+            workspaceId,
+            sessionId,
+            // No receiving turn exists when every candidate was
+            // cancelled before a model batch could be persisted.
+            turnId: null,
+            turnGeneration: null,
+            turnAttemptId: null,
+            turnAssociation: null,
+            sequence: nextSequence,
+            type: "system.update.cancelled",
+            payload: sanitizeEventPayload({
+              updateIds: cancelledUpdateIds,
+              count: cancelledUpdateIds.length,
+              reason: "stale_goal_continuation"
+            }),
+            occurredAt
+          } : null;
           return {
             count: 0,
-            lastSequence: nextSequence - 1,
+            lastSequence: cancellationEvent ? nextSequence : nextSequence - 1,
             triggerEventId: null,
+            historyItemId: null,
+            historyItem: null,
             updates: [],
+            events: cancellationEvent ? [cancellationEvent] : [],
             event: null
           };
         }
+        const modelOrdered = [
+          ...deliverable.filter((update) => update.kind !== "agent_steer_instruction"),
+          ...deliverable.filter((update) => update.kind === "agent_steer_instruction")
+        ];
+        const historyItemId = crypto.randomUUID();
+        const historyItem = sessionSystemUpdateBatchHistoryItem(
+          modelOrdered.map((update) => mapSessionSystemUpdate(update))
+        );
         await tx.update(sessionSystemUpdates).set({
           state: "delivered",
           deliveredTurnId: turnId,
+          deliveredHistoryItemId: historyItemId,
           deliveredAt: occurredAt
         }).where(
           and7(
@@ -22634,6 +22921,27 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           )
         );
         const eventId = triggerEventId ?? crypto.randomUUID();
+        let sequence = nextSequence - 1;
+        const events = [];
+        if (cancelledUpdateIds.length > 0) {
+          events.push({
+            accountId,
+            workspaceId,
+            sessionId,
+            turnId,
+            turnGeneration,
+            turnAttemptId: input.attemptId,
+            turnAssociation: "current",
+            sequence: ++sequence,
+            type: "system.update.cancelled",
+            payload: sanitizeEventPayload({
+              updateIds: cancelledUpdateIds,
+              count: cancelledUpdateIds.length,
+              reason: "stale_goal_continuation"
+            }),
+            occurredAt
+          });
+        }
         const event = {
           id: eventId,
           accountId,
@@ -22643,23 +22951,55 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           turnGeneration,
           turnAttemptId: input.attemptId,
           turnAssociation: "current",
-          sequence: nextSequence,
+          sequence: ++sequence,
           type: "system.update.delivered",
           payload: sanitizeEventPayload({
             updateIds: deliverable.map((update) => update.id),
+            historyItemId,
             count: deliverable.length,
-            classifications: [...new Set(deliverable.map((update) => update.classification))]
+            classifications: [...new Set(deliverable.map((update) => update.classification))],
+            members: modelOrdered.map(internalUpdateEventMember)
           }),
           occurredAt
         };
+        events.push(event);
         return {
           count: deliverable.length,
-          lastSequence: nextSequence,
+          lastSequence: sequence,
           triggerEventId: eventId,
+          historyItemId,
+          historyItem,
           updates: deliverable,
+          events,
           event
         };
       };
+      const persistDeliveredUpdateBatch = async (delivered2, accountId, turnId) => {
+        if (!delivered2.historyItemId || !delivered2.historyItem) {
+          if (delivered2.count !== 0) {
+            throw new Error("Delivered machine-input batch has no model-memory item");
+          }
+          return;
+        }
+        const [{ position } = { position: 0 }] = await tx.select({
+          position: sql4`coalesce(max(${sessionHistoryItems.position}), -1) + 1`
+        }).from(sessionHistoryItems).where(
+          and7(
+            eq7(sessionHistoryItems.workspaceId, workspaceId),
+            eq7(sessionHistoryItems.sessionId, sessionId)
+          )
+        );
+        await tx.insert(sessionHistoryItems).values({
+          id: delivered2.historyItemId,
+          accountId,
+          workspaceId,
+          sessionId,
+          turnId,
+          position: Number(position),
+          item: sanitizeModelPayload(delivered2.historyItem),
+          producerCodexCredentialId: null
+        });
+      };
       const workspaceControl = await lockWorkspaceInferenceControl(
         tx,
         workspaceId,
@@ -22694,6 +23034,12 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
         and7(
           eq7(sessionAttemptInterruptions.workspaceId, workspaceId),
           eq7(sessionAttemptInterruptions.sessionId, sessionId),
+          inArray3(sessionAttemptInterruptions.state, [
+            "pending",
+            "delivered",
+            "acknowledged",
+            "settled"
+          ]),
           isNull2(sessionTurnAttempts.quiescedAt)
         )
       ).orderBy(desc2(sessionAttemptInterruptions.requestedAt)).limit(1);
@@ -22899,17 +23245,21 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           eq7(sessionSystemUpdates.workspaceId, workspaceId),
           eq7(sessionSystemUpdates.sessionId, sessionId),
           eq7(sessionSystemUpdates.kind, "agent_steer_instruction"),
-          inArray3(sessionSystemUpdates.state, ["pending", "deferred"])
+          eq7(sessionSystemUpdates.state, "pending")
         )
       ).orderBy(
         desc2(sessionSystemUpdates.createdAt),
         desc2(sessionSystemUpdates.id)
       ).limit(1).for("update");
-      const rows = pendingAgentSteer ? [] : await rawRows(
+      const rows = await rawRows(
         tx,
         sql4`select id, trigger_event_id, metadata from session_turns
               where workspace_id = ${workspaceId} and session_id = ${sessionId}
                 and status = 'queued' and source in ('user', 'api')
+                and (
+                  ${Boolean(pendingAgentSteer)} = false
+                  or metadata->>'delivery' = 'steer'
+                )
               order by position asc, created_at asc, id asc
               limit 1`
       );
@@ -23073,6 +23423,19 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           triggerEventId
         );
         if (delivered2.count === 0) {
+          if (delivered2.events.length > 0) {
+            await tx.insert(sessionEvents).values(delivered2.events);
+            await tx.update(sessions).set({
+              status: "idle",
+              lastSequence: delivered2.lastSequence,
+              updatedAt: now2
+            }).where(
+              and7(
+                eq7(sessions.workspaceId, workspaceId),
+                eq7(sessions.id, sessionId)
+              )
+            );
+          }
           return { action: "unclaimed", reason: "no-work" };
         }
         const goalUpdate = delivered2.updates.find(
@@ -23211,9 +23574,10 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           startedAt: now2
         }).returning();
         if (!internalTurn) throw new Error("Failed to create internal update inference");
+        await persistDeliveredUpdateBatch(delivered2, session.accountId, internalTurn.id);
         await registerAttempt(internalTurn);
         if (!delivered2.event) throw new Error("Delivered update batch has no durable event");
-        await tx.insert(sessionEvents).values(delivered2.event);
+        await tx.insert(sessionEvents).values(delivered2.events);
         if (goalUpdate && typeof goalUpdate.payload.goalId === "string") {
           await tx.update(sessionGoals).set({ lastContinuationTurnId: internalTurn.id, updatedAt: now2 }).where(
             and7(
@@ -23310,8 +23674,9 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
         session.lastSequence + 1,
         now
       );
-      if (delivered.event) {
-        await tx.insert(sessionEvents).values(delivered.event);
+      await persistDeliveredUpdateBatch(delivered, session.accountId, row.id);
+      if (delivered.events.length > 0) {
+        await tx.insert(sessionEvents).values(delivered.events);
       }
       await tx.update(sessions).set({
         status: "running",
@@ -23455,6 +23820,127 @@ async function markSessionAttemptQuiesced(db, input) {
     return [mapEvent2(event)];
   });
 }
+async function getSessionAttemptActivityRef(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const [attempt] = await scopedDb.select({
+        workflowId: sessionTurnAttempts.temporalWorkflowId,
+        workflowRunId: sessionTurnAttempts.temporalWorkflowRunId,
+        activityId: sessionTurnAttempts.temporalActivityId,
+        quiescedAt: sessionTurnAttempts.quiescedAt
+      }).from(sessionTurnAttempts).where(
+        and7(
+          eq7(sessionTurnAttempts.accountId, input.accountId),
+          eq7(sessionTurnAttempts.workspaceId, input.workspaceId),
+          eq7(sessionTurnAttempts.sessionId, input.sessionId),
+          eq7(sessionTurnAttempts.id, input.attemptId),
+          eq7(sessionTurnAttempts.temporalWorkflowId, input.temporalWorkflowId)
+        )
+      ).limit(1);
+      return attempt ? {
+        workflowId: attempt.workflowId,
+        workflowRunId: attempt.workflowRunId,
+        activityId: attempt.activityId,
+        quiesced: attempt.quiescedAt !== null
+      } : null;
+    }
+  );
+}
+async function reconcileSessionAttemptQuiescence(db, input) {
+  const eligibility = await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const rows = await scopedDb.execute(sql4`
+        select
+          attempt.account_id,
+          attempt.state,
+          attempt.quiesced_at,
+          attempt.temporal_workflow_id,
+          attempt.temporal_workflow_run_id,
+          attempt.temporal_activity_id,
+          exists (
+            select 1
+            from session_attempt_interruptions interruption
+            where interruption.workspace_id = attempt.workspace_id
+              and interruption.session_id = attempt.session_id
+              and interruption.attempt_id = attempt.id
+              and interruption.state in ('settled', 'rejected_stale')
+          ) as interruption_settled,
+          exists (
+            select 1
+            from session_attempt_interruptions interruption
+            where interruption.workspace_id = attempt.workspace_id
+              and interruption.session_id = attempt.session_id
+              and interruption.attempt_id = attempt.id
+              and interruption.state in ('pending', 'delivered', 'acknowledged')
+          ) as interruption_pending,
+          (
+            exists (
+              select 1
+              from sandbox_workspace_mutation_admissions admission
+              where admission.account_id = attempt.account_id
+                and admission.workspace_id = attempt.workspace_id
+                and admission.session_id = attempt.session_id
+                and admission.settled_at is null
+                and (
+                  admission.attempt_id = attempt.id
+                  or (
+                    admission.actor_kind = 'process'
+                    and exists (
+                      select 1
+                      from sandbox_retained_processes process
+                      where process.account_id = attempt.account_id
+                        and process.workspace_id = attempt.workspace_id
+                        and process.session_id = attempt.session_id
+                        and process.id = admission.actor_id
+                        and process.owner_attempt_id = attempt.id
+                    )
+                  )
+                )
+            )
+            or exists (
+              select 1
+              from sandbox_retained_processes process
+              where process.account_id = attempt.account_id
+                and process.workspace_id = attempt.workspace_id
+                and process.session_id = attempt.session_id
+                and process.owner_attempt_id = attempt.id
+                and process.state = 'active'
+            )
+          ) as writer_pending
+        from session_turn_attempts attempt
+        where attempt.account_id = ${input.accountId}
+          and attempt.workspace_id = ${input.workspaceId}
+          and attempt.session_id = ${input.sessionId}
+          and attempt.id = ${input.attemptId}
+        limit 1
+      `);
+      return rows[0] ?? null;
+    }
+  );
+  if (!eligibility || eligibility.account_id !== input.accountId || eligibility.temporal_workflow_id !== input.temporalWorkflowId || eligibility.temporal_workflow_run_id !== input.temporalWorkflowRunId || eligibility.temporal_activity_id !== input.temporalActivityId || eligibility.state !== "closed" || !eligibility.interruption_settled || eligibility.interruption_pending) {
+    return { action: "stale", events: [] };
+  }
+  if (eligibility.quiesced_at) {
+    return { action: "quiesced", events: [] };
+  }
+  if (!input.activitySettled || eligibility.writer_pending) {
+    return { action: "pending", events: [] };
+  }
+  const events = await markSessionAttemptQuiesced(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    sessionId: input.sessionId,
+    attemptId: input.attemptId,
+    temporalWorkflowId: input.temporalWorkflowId,
+    temporalWorkflowRunId: input.temporalWorkflowRunId,
+    temporalActivityId: input.temporalActivityId
+  });
+  return { action: "quiesced", events };
+}
 async function settleSessionAttemptInterruptions(db, workspaceId, sessionId, attemptId) {
   return await withWorkspaceRls(
     db,
@@ -23583,12 +24069,6 @@ async function settleSessionAttemptInterruptions(db, workspaceId, sessionId, att
         outcome,
         closedAt: now
       });
-      await requeueInterruptedSessionSystemUpdatesForTurnTx(
-        tx,
-        workspaceId,
-        sessionId,
-        turn.id
-      );
       const eventValues = steer ? [
         {
           accountId: session.accountId,
@@ -24458,10 +24938,36 @@ async function applySessionTurnSettlement(db, workspaceId, input) {
           }
         })
       );
+      const settledMachineInputs = ["completed", "failed", "cancelled", "superseded"].includes(
+        input.turnStatus
+      ) ? await tx.select({
+        id: sessionSystemUpdates.id,
+        historyItemId: sessionSystemUpdates.deliveredHistoryItemId
+      }).from(sessionSystemUpdates).where(
+        and7(
+          eq7(sessionSystemUpdates.workspaceId, workspaceId),
+          eq7(sessionSystemUpdates.sessionId, input.sessionId),
+          eq7(sessionSystemUpdates.deliveredTurnId, input.turnId),
+          eq7(sessionSystemUpdates.state, "delivered")
+        )
+      ).orderBy(
+        asc4(sessionSystemUpdates.createdAt),
+        asc4(sessionSystemUpdates.id)
+      ) : [];
+      const machineInputSettlementEvent = settledMachineInputs.length > 0 ? {
+        type: "system.update.settled",
+        payload: {
+          updateIds: settledMachineInputs.map((update) => update.id),
+          count: settledMachineInputs.length,
+          historyItemId: settledMachineInputs[0].historyItemId,
+          outcome: input.turnStatus
+        }
+      } : null;
       const settlementEvents = [
         ...recordingEvent ? [recordingEvent] : [],
         ...compactionRequestEvent ? [compactionRequestEvent] : [],
         ...terminalHumanInputEvents,
+        ...machineInputSettlementEvent ? [machineInputSettlementEvent] : [],
         ...input.events
       ];
       const values = settlementEvents.map((event) => {
@@ -24517,21 +25023,6 @@ async function applySessionTurnSettlement(db, workspaceId, input) {
           turn
         );
       }
-      if (input.turnStatus === "failed") {
-        await deferFailedSessionSystemUpdatesForTurnTx(
-          tx,
-          workspaceId,
-          input.sessionId,
-          input.turnId
-        );
-      } else if (["cancelled", "superseded"].includes(input.turnStatus)) {
-        await requeueInterruptedSessionSystemUpdatesForTurnTx(
-          tx,
-          workspaceId,
-          input.sessionId,
-          input.turnId
-        );
-      }
       await tx.update(sessions).set({
         status: effectiveSessionStatus,
         activeTurnId: input.activeTurnId,
@@ -24729,14 +25220,6 @@ async function settleCodexCredentialLeaseLoss(db, input) {
           eq7(sessions.activeTurnId, input.turnId)
         )
       );
-      if (!input.checkpointDurable) {
-        await deferFailedSessionSystemUpdatesForTurnTx(
-          tx,
-          input.workspaceId,
-          input.sessionId,
-          input.turnId
-        );
-      }
       await tx.execute(sql4`
           delete from codex_credential_leases
           where account_id = ${input.accountId}
@@ -25407,16 +25890,49 @@ async function getSessionQueueSnapshot(db, workspaceId, sessionId) {
         inArray3(sessionTurns.source, ["user", "api"])
       )
     ).orderBy(asc4(sessionTurns.position), asc4(sessionTurns.createdAt));
+    const pendingInputs = await scopedDb.select().from(sessionSystemUpdates).where(
+      and7(
+        eq7(sessionSystemUpdates.workspaceId, workspaceId),
+        eq7(sessionSystemUpdates.sessionId, sessionId),
+        eq7(sessionSystemUpdates.state, "pending")
+      )
+    ).orderBy(
+      sql4`case when ${sessionSystemUpdates.kind} = 'agent_steer_instruction' then 0 else 1 end`,
+      asc4(sessionSystemUpdates.createdAt),
+      asc4(sessionSystemUpdates.id)
+    );
     const latestInterruption = await latestSessionAttemptInterruption(
       scopedDb,
       workspaceId,
       sessionId
     );
+    const items = rows.map(mapSessionTurn);
+    const nextInputBatch = selectBoundedSystemUpdateBatch(pendingInputs);
+    const hasPendingAgentSteer = pendingInputs.some(
+      (update) => update.kind === "agent_steer_instruction"
+    );
+    const attachmentTurn = hasPendingAgentSteer ? items.find((turn) => turn.metadata.delivery === "steer") : items[0];
     return {
       version: session.queueVersion,
       effectiveControl: serializeEffectiveSessionControl(effectiveControl),
-      stoppingPreviousAttempt: latestInterruption !== null && latestInterruption.quiescedAt === null,
-      items: rows.map(mapSessionTurn)
+      stoppingPreviousAttempt: latestInterruption !== null && latestInterruption.interruptionState !== "rejected_stale" && latestInterruption.quiescedAt === null,
+      items,
+      pendingInputs: pendingInputs.map((update) => {
+        const canonical = mapSessionSystemUpdate(update);
+        return {
+          id: canonical.id,
+          sessionId: canonical.sessionId,
+          kind: canonical.kind,
+          classification: canonical.classification,
+          sourceId: boundedInternalUpdateEventText(canonical.sourceId, 256).text,
+          summary: boundedInternalUpdateEventText(canonical.summary, 512).text,
+          createdAt: canonical.createdAt
+        };
+      }),
+      pendingInputAttachment: attachmentTurn && nextInputBatch.length > 0 ? {
+        turnId: attachmentTurn.id,
+        inputIds: nextInputBatch.map((update) => update.id)
+      } : null
     };
   });
 }
@@ -25625,6 +26141,30 @@ async function markSessionWorkflowWakeDelivered(db, input) {
         if (pendingAgentSteer) {
           return { action: "pending_admission", blocker: "pending_agent_steer" };
         }
+        const [pendingQuiescence] = await tx.select({ id: sessionTurnAttempts.id }).from(sessionTurnAttempts).innerJoin(
+          sessionAttemptInterruptions,
+          and7(
+            eq7(
+              sessionAttemptInterruptions.workspaceId,
+              sessionTurnAttempts.workspaceId
+            ),
+            eq7(
+              sessionAttemptInterruptions.sessionId,
+              sessionTurnAttempts.sessionId
+            ),
+            eq7(sessionAttemptInterruptions.attemptId, sessionTurnAttempts.id)
+          )
+        ).where(
+          and7(
+            eq7(sessionTurnAttempts.workspaceId, input.workspaceId),
+            eq7(sessionTurnAttempts.sessionId, input.sessionId),
+            isNull2(sessionTurnAttempts.quiescedAt),
+            inArray3(sessionAttemptInterruptions.state, ["settled", "rejected_stale"])
+          )
+        ).limit(1);
+        if (pendingQuiescence) {
+          return { action: "pending_admission", blocker: "pending_quiescence" };
+        }
       }
       const [row] = await tx.update(sessionWorkflowWakeOutbox).set({
         deliveredRevision: sql4`greatest(${sessionWorkflowWakeOutbox.deliveredRevision}, ${input.wakeRevision})`,
@@ -25780,30 +26320,6 @@ async function addSessionSystemUpdate(db, input) {
   }
   return await addSessionSystemUpdateWithSourceMutation(db, input, async () => void 0);
 }
-async function requeueInterruptedSessionSystemUpdatesForTurnTx(tx, workspaceId, sessionId, turnId) {
-  await tx.update(sessionSystemUpdates).set({ state: "pending", deliveredTurnId: null, deliveredAt: null }).where(
-    and7(
-      eq7(sessionSystemUpdates.workspaceId, workspaceId),
-      eq7(sessionSystemUpdates.sessionId, sessionId),
-      eq7(sessionSystemUpdates.deliveredTurnId, turnId),
-      eq7(sessionSystemUpdates.state, "delivered")
-    )
-  );
-}
-async function deferFailedSessionSystemUpdatesForTurnTx(tx, workspaceId, sessionId, turnId) {
-  await tx.update(sessionSystemUpdates).set({
-    state: sql4`case when ${sessionSystemUpdates.payload} ->> 'type' = 'goal_continuation' then 'failed' else 'deferred' end`,
-    deliveredTurnId: null,
-    deliveredAt: null
-  }).where(
-    and7(
-      eq7(sessionSystemUpdates.workspaceId, workspaceId),
-      eq7(sessionSystemUpdates.sessionId, sessionId),
-      eq7(sessionSystemUpdates.deliveredTurnId, turnId),
-      eq7(sessionSystemUpdates.state, "delivered")
-    )
-  );
-}
 async function addSessionSystemUpdateWithSourceMutation(db, input, mutateSource) {
   if (Buffer.byteLength(JSON.stringify(input.payload)) > MAX_INTERNAL_UPDATE_BYTES) {
     throw new Error(`Internal update payload exceeds ${MAX_INTERNAL_UPDATE_BYTES} bytes`);
@@ -25882,6 +26398,7 @@ async function addSessionSystemUpdateWithSourceMutation(db, input, mutateSource)
         };
       }
       const now = /* @__PURE__ */ new Date();
+      const eventPreview = internalUpdateEventMember(inserted);
       const [event] = await tx.insert(sessionEvents).values({
         accountId: session.accountId,
         workspaceId: input.workspaceId,
@@ -25889,11 +26406,13 @@ async function addSessionSystemUpdateWithSourceMutation(db, input, mutateSource)
         sequence: session.lastSequence + 1,
         type: "system.update.pending",
         payload: sanitizeEventPayload({
-          updateId: inserted.id,
-          kind: input.kind,
-          classification: input.classification,
-          sourceId: input.sourceId,
-          summary: input.summary
+          updateId: eventPreview.id,
+          kind: eventPreview.kind,
+          classification: eventPreview.classification,
+          sourceId: eventPreview.sourceId,
+          sourceIdTruncated: eventPreview.sourceIdTruncated,
+          summary: eventPreview.summary,
+          summaryTruncated: eventPreview.summaryTruncated
         }),
         occurredAt: now
       }).returning();
@@ -25930,7 +26449,7 @@ async function listOutstandingSessionSystemUpdates(db, workspaceId, sessionId) {
       and7(
         eq7(sessionSystemUpdates.workspaceId, workspaceId),
         eq7(sessionSystemUpdates.sessionId, sessionId),
-        inArray3(sessionSystemUpdates.state, ["pending", "deferred"])
+        eq7(sessionSystemUpdates.state, "pending")
       )
     ).orderBy(asc4(sessionSystemUpdates.createdAt), asc4(sessionSystemUpdates.id));
     return rows.map(mapSessionSystemUpdate);
@@ -25971,6 +26490,7 @@ function mapSessionSystemUpdate(row) {
     lineage: row.lineage,
     state: row.state,
     deliveredTurnId: row.deliveredTurnId,
+    deliveredHistoryItemId: row.deliveredHistoryItemId,
     deliveredAt: row.deliveredAt?.toISOString() ?? null,
     createdAt: row.createdAt.toISOString()
   };
@@ -26571,6 +27091,7 @@ function mapSession(row, effectiveControl, mcpServers = [], pin = mapSessionPin(
     titleSource: row.titleSource ?? null,
     instructions: row.instructions ?? null,
     resources: row.resources,
+    skills: row.skills ?? [],
     tools: row.tools,
     toolPolicy: row.toolPolicy ?? {
       mode: "legacy",
@@ -26600,6 +27121,7 @@ function mapSession(row, effectiveControl, mcpServers = [], pin = mapSessionPin(
     rigId: row.rigId ?? null,
     rigVersionId: row.rigVersionId ?? null,
     firstPartyMcpPermissions: row.firstPartyMcpPermissions ?? null,
+    firstPartyMcpTools: row.firstPartyMcpTools ?? null,
     mcpServers,
     parentSessionId: row.parentSessionId ?? null,
     rootSessionId: row.rootSessionId,
@@ -27314,6 +27836,7 @@ export {
   SessionPinVersionConflictError,
   SessionSpawnDeniedDbError,
   SessionToolPolicyVersionConflictError,
+  SlackBotLifecycleSuccessAuditError,
   WORKSPACE_MEMORY_BLOCK_EMPTY,
   WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED,
   WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET,
@@ -27417,6 +27940,7 @@ export {
   countWorkspacesForAccount,
   createApiKey,
   createConnection,
+  createConnectionWithSlackBotSuccessAudit,
   createDb,
   createDeviceEnrollmentRequest,
   createEnrollment,
@@ -27543,6 +28067,7 @@ export {
   getSandboxSessionEnvelope,
   getScheduledTask,
   getSession,
+  getSessionAttemptActivityRef,
   getSessionByCreateIdempotencyKey,
   getSessionCodexState,
   getSessionEvent,
@@ -27714,6 +28239,7 @@ export {
   reapStaleLeaseHoldersGlobal,
   reconcileCodexCapacityWait,
   reconcileColdLostLeaseInstanceBlockers,
+  reconcileSessionAttemptQuiescence,
   recordAuditEvent,
   recordCodexAccountConnectors,
   recordCodexAccountUsage,
@@ -27727,6 +28253,7 @@ export {
   recordRetainedProcessReconciliationProof,
   recordSessionActiveCodexCredential,
   recordSkippedContextCompaction,
+  recordSlackBotInstallCallbackFailure,
   recordStreamAcknowledgment,
   recordStripeWebhookEvent,
   recordUsageEvent,
@@ -27765,6 +28292,7 @@ export {
   retireHostExportConsumer,
   revokeApiKey,
   revokeConnection,
+  revokeConnectionWithSlackBotSuccessAudit,
   revokeEnrollment,
   revokeViewer,
   rewindHostExportConsumer,
@@ -27833,6 +28361,7 @@ export {
   updateCodexAllocatorEligibility,
   updateCodexRotationSettings,
   updateConnection,
+  updateConnectionWithSlackBotSuccessAudit,
   updateImportBatchCounts,
   updateKnowledgeMemory,
   updatePackInstallationStatus,