@opengeni/db 0.13.1 → 0.14.0

package/src/index.ts

@@ -16,6 +16,7 @@ import type {
   FileAsset,
   FileStatus,
   FileUploadStatus,
+  FirstPartyMcpToolName,
   HumanInputAnswer,
   HumanInputQuestion,
   HumanInputResponse,
@@ -59,6 +60,7 @@ import type {
   SessionHumanInputRequest,
   LineageNode,
   SessionMcpApprovalPolicy,
+  SessionSkill,
   SessionMcpServerMetadata,
   SessionStatus,
   SessionToolPolicy,
@@ -112,6 +114,7 @@ import {
   RigChange as RigChangeContract,
   SessionGoal as SessionGoalContract,
   SessionSystemUpdatePayload,
+  sessionSystemUpdateBatchHistoryItem,
   HostEventExport as HostEventExportContract,
   HostEventExportBatch as HostEventExportBatchContract,
   HostExportConsumerId,
@@ -1338,6 +1341,24 @@ export async function bootstrapWorkspace(
         })
         .where(eq(schema.workspaceMemberships.id, membership.id));
     }
+    // Access refreshes must retain workspaces created or granted after the
+    // default workspace. Restore account-scoped RLS before listing them.
+    await setRlsContext(tx as unknown as Database, {
+      accountId: workspace.accountId,
+      workspaceId: null,
+    });
+    const memberships = await tx
+      .select({
+        membership: schema.workspaceMemberships,
+        workspace: schema.workspaces,
+      })
+      .from(schema.workspaceMemberships)
+      .innerJoin(
+        schema.workspaces,
+        eq(schema.workspaceMemberships.workspaceId, schema.workspaces.id),
+      )
+      .where(eq(schema.workspaceMemberships.subjectId, input.subjectId))
+      .orderBy(desc(schema.workspaces.createdAt));
     return {
       mode: input.accountExternalSource === "opengeni:local" ? "local" : "configured",
       subjectId: input.subjectId,
@@ -1351,15 +1372,13 @@ export async function bootstrapWorkspace(
           permissions: input.accountPermissions ?? allAccountPermissions,
         },
       ],
-      workspaceGrants: [
-        {
-          workspaceId: workspace.id,
-          accountId: account.id,
-          subjectId: input.subjectId,
-          ...(input.subjectLabel ? { subjectLabel: input.subjectLabel } : {}),
-          permissions: workspacePermissions,
-        },
-      ],
+      workspaceGrants: memberships.map((row) => ({
+        workspaceId: row.workspace.id,
+        accountId: row.workspace.accountId,
+        subjectId: input.subjectId,
+        ...(input.subjectLabel ? { subjectLabel: input.subjectLabel } : {}),
+        permissions: row.membership.permissions as Permission[],
+      })),
       defaultAccountId: account.id,
       defaultWorkspaceId: workspace.id,
     };
@@ -4772,6 +4791,52 @@ function connectionSubjectVisibility(subjectId?: string | null): SQL {
     : isNull(schema.connections.subjectId);
 }
 
+function connectionExactSubject(subjectId?: string | null): SQL {
+  return subjectId
+    ? eq(schema.connections.subjectId, subjectId)
+    : isNull(schema.connections.subjectId);
+}
+
+async function withConnectionSubjectRls<T>(
+  db: Database,
+  workspaceId: string,
+  subjectId: string | null | undefined,
+  fn: (db: Database) => Promise<T>,
+): Promise<T> {
+  return subjectId
+    ? await withWorkspaceSubjectRls(db, workspaceId, subjectId, fn)
+    : await withWorkspaceRls(db, workspaceId, fn);
+}
+
+async function createConnectionInScope(
+  db: Database,
+  input: CreateConnectionInput,
+): Promise<ConnectionMetadataWithVerification> {
+  const [row] = await db
+    .insert(schema.connections)
+    .values({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId ?? null,
+      providerDomain: input.providerDomain,
+      kind: input.kind,
+      status: input.status ?? "active",
+      credentialEncrypted: input.credentialEncrypted,
+      grantedScopes: input.grantedScopes ?? [],
+      expiresAt: input.expiresAt ?? null,
+      verifiedInstallAt: input.verifiedInstallAt ?? null,
+      verifiedInstallVersion: input.verifiedInstallVersion ?? null,
+      metadata: input.metadata ?? {},
+      createdBySubjectId: input.createdBySubjectId ?? null,
+      updatedBySubjectId: input.updatedBySubjectId ?? input.createdBySubjectId ?? null,
+    })
+    .returning(connectionMetadataColumns);
+  if (!row) {
+    throw new Error("Failed to create connection");
+  }
+  return mapConnectionMetadata(row);
+}
+
 export async function createConnection(
   db: Database,
   input: CreateConnectionInput,
@@ -4780,29 +4845,10 @@ export async function createConnection(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const [row] = await scopedDb
-        .insert(schema.connections)
-        .values({
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          subjectId: input.subjectId ?? null,
-          providerDomain: input.providerDomain,
-          kind: input.kind,
-          status: input.status ?? "active",
-          credentialEncrypted: input.credentialEncrypted,
-          grantedScopes: input.grantedScopes ?? [],
-          expiresAt: input.expiresAt ?? null,
-          verifiedInstallAt: input.verifiedInstallAt ?? null,
-          verifiedInstallVersion: input.verifiedInstallVersion ?? null,
-          metadata: input.metadata ?? {},
-          createdBySubjectId: input.createdBySubjectId ?? null,
-          updatedBySubjectId: input.updatedBySubjectId ?? input.createdBySubjectId ?? null,
-        })
-        .returning(connectionMetadataColumns);
-      if (!row) {
-        throw new Error("Failed to create connection");
+      if (input.subjectId) {
+        await setSubjectRlsContext(scopedDb, input.subjectId);
       }
-      return mapConnectionMetadata(row);
+      return await createConnectionInScope(scopedDb, input);
     },
   );
 }
@@ -4812,7 +4858,7 @@ export async function listConnectionsMetadata(
   workspaceId: string,
   subjectId?: string | null,
 ): Promise<ConnectionMetadataWithVerification[]> {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const rows = await scopedDb
       .select(connectionMetadataColumns)
       .from(schema.connections)
@@ -4833,7 +4879,7 @@ export async function getConnectionMetadata(
   connectionId: string,
   subjectId?: string | null,
 ): Promise<ConnectionMetadataWithVerification | null> {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const [row] = await scopedDb
       .select(connectionMetadataColumns)
       .from(schema.connections)
@@ -4849,53 +4895,102 @@ export async function getConnectionMetadata(
   });
 }
 
+async function updateConnectionInScope(
+  db: Database,
+  input: UpdateConnectionInput,
+): Promise<ConnectionMetadataWithVerification | null> {
+  const set = {
+    updatedAt: new Date(),
+    ...(input.providerDomain !== undefined ? { providerDomain: input.providerDomain } : {}),
+    ...(input.subjectId !== undefined ? { subjectId: input.subjectId } : {}),
+    ...(input.kind !== undefined ? { kind: input.kind } : {}),
+    ...(input.status !== undefined ? { status: input.status } : {}),
+    ...(input.credentialEncrypted !== undefined
+      ? {
+          credentialEncrypted: input.credentialEncrypted,
+          version: sql`${schema.connections.version} + 1`,
+          lastError: null,
+        }
+      : {}),
+    ...(input.grantedScopes !== undefined ? { grantedScopes: input.grantedScopes } : {}),
+    ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
+    ...(input.verifiedInstallAt !== undefined
+      ? { verifiedInstallAt: input.verifiedInstallAt }
+      : {}),
+    ...(input.verifiedInstallVersion !== undefined
+      ? { verifiedInstallVersion: input.verifiedInstallVersion }
+      : {}),
+    ...(input.metadata !== undefined ? { metadata: input.metadata } : {}),
+    ...(input.updatedBySubjectId !== undefined
+      ? { updatedBySubjectId: input.updatedBySubjectId }
+      : {}),
+  };
+  const [row] = await db
+    .update(schema.connections)
+    .set(set)
+    .where(
+      and(
+        eq(schema.connections.workspaceId, input.workspaceId),
+        eq(schema.connections.id, input.connectionId),
+        connectionSubjectVisibility(input.visibleToSubjectId),
+        ...(input.expectedVersion !== undefined
+          ? [eq(schema.connections.version, input.expectedVersion)]
+          : []),
+      ),
+    )
+    .returning(connectionMetadataColumns);
+  return row ? mapConnectionMetadata(row) : null;
+}
+
 export async function updateConnection(
   db: Database,
   input: UpdateConnectionInput,
 ): Promise<ConnectionMetadataWithVerification | null> {
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const set = {
+  return await withConnectionSubjectRls(
+    db,
+    input.workspaceId,
+    input.visibleToSubjectId,
+    async (scopedDb) => await updateConnectionInScope(scopedDb, input),
+  );
+}
+
+async function revokeConnectionInScope(
+  db: Database,
+  workspaceId: string,
+  connectionId: string,
+  updatedBySubjectId?: string | null,
+  expectedVersion?: number,
+): Promise<ConnectionMetadataWithVerification | null> {
+  const [row] = await db
+    .update(schema.connections)
+    .set({
+      status: "revoked",
+      // The version bump invalidates any in-flight refresh's (id, version) CAS,
+      // so a racing refresh cannot commit and flip the row back to active.
+      version: sql`${schema.connections.version} + 1`,
+      // Status-only revocation does not replace the verified credential or bot
+      // identity. Carry the marker to the same new CAS version so the dedicated
+      // reinstall path can still recognize (but not use) the inactive row.
+      verifiedInstallVersion: sql`case
+        when ${schema.connections.verifiedInstallAt} is null then null
+        else ${schema.connections.version} + 1
+      end`,
+      updatedBySubjectId: updatedBySubjectId ?? null,
       updatedAt: new Date(),
-      ...(input.providerDomain !== undefined ? { providerDomain: input.providerDomain } : {}),
-      ...(input.subjectId !== undefined ? { subjectId: input.subjectId } : {}),
-      ...(input.kind !== undefined ? { kind: input.kind } : {}),
-      ...(input.status !== undefined ? { status: input.status } : {}),
-      ...(input.credentialEncrypted !== undefined
-        ? {
-            credentialEncrypted: input.credentialEncrypted,
-            version: sql`${schema.connections.version} + 1`,
-            lastError: null,
-          }
-        : {}),
-      ...(input.grantedScopes !== undefined ? { grantedScopes: input.grantedScopes } : {}),
-      ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
-      ...(input.verifiedInstallAt !== undefined
-        ? { verifiedInstallAt: input.verifiedInstallAt }
-        : {}),
-      ...(input.verifiedInstallVersion !== undefined
-        ? { verifiedInstallVersion: input.verifiedInstallVersion }
-        : {}),
-      ...(input.metadata !== undefined ? { metadata: input.metadata } : {}),
-      ...(input.updatedBySubjectId !== undefined
-        ? { updatedBySubjectId: input.updatedBySubjectId }
-        : {}),
-    };
-    const [row] = await scopedDb
-      .update(schema.connections)
-      .set(set)
-      .where(
-        and(
-          eq(schema.connections.workspaceId, input.workspaceId),
-          eq(schema.connections.id, input.connectionId),
-          connectionSubjectVisibility(input.visibleToSubjectId),
-          ...(input.expectedVersion !== undefined
-            ? [eq(schema.connections.version, input.expectedVersion)]
-            : []),
-        ),
-      )
-      .returning(connectionMetadataColumns);
-    return row ? mapConnectionMetadata(row) : null;
-  });
+    })
+    .where(
+      and(
+        eq(schema.connections.workspaceId, workspaceId),
+        eq(schema.connections.id, connectionId),
+        // Same visibility rule as get/update: shared rows plus the caller's own
+        // subject rows. Cross-subject revocation (admin janitorial) arrives with
+        // the subject-connections UX in I5, deliberately not before.
+        connectionSubjectVisibility(updatedBySubjectId),
+        ...(expectedVersion !== undefined ? [eq(schema.connections.version, expectedVersion)] : []),
+      ),
+    )
+    .returning(connectionMetadataColumns);
+  return row ? mapConnectionMetadata(row) : null;
 }
 
 export async function revokeConnection(
@@ -4904,39 +4999,244 @@ export async function revokeConnection(
   connectionId: string,
   updatedBySubjectId?: string | null,
 ): Promise<ConnectionMetadataWithVerification | null> {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb
-      .update(schema.connections)
-      .set({
-        status: "revoked",
-        // The version bump invalidates any in-flight refresh's (id, version) CAS,
-        // so a racing refresh cannot commit and flip the row back to active.
-        version: sql`${schema.connections.version} + 1`,
-        // Status-only revocation does not replace the verified credential or bot
-        // identity. Carry the marker to the same new CAS version so the dedicated
-        // reinstall path can still recognize (but not use) the inactive row.
-        verifiedInstallVersion: sql`case
-          when ${schema.connections.verifiedInstallAt} is null then null
-          else ${schema.connections.version} + 1
-        end`,
-        updatedBySubjectId: updatedBySubjectId ?? null,
-        updatedAt: new Date(),
-      })
-      .where(
-        and(
-          eq(schema.connections.workspaceId, workspaceId),
-          eq(schema.connections.id, connectionId),
-          // Same visibility rule as get/update: shared rows plus the caller's own
-          // subject rows. Cross-subject revocation (admin janitorial) arrives with
-          // the subject-connections UX in I5, deliberately not before.
-          connectionSubjectVisibility(updatedBySubjectId),
-        ),
-      )
-      .returning(connectionMetadataColumns);
-    return row ? mapConnectionMetadata(row) : null;
+  return await withConnectionSubjectRls(
+    db,
+    workspaceId,
+    updatedBySubjectId,
+    async (scopedDb) =>
+      await revokeConnectionInScope(scopedDb, workspaceId, connectionId, updatedBySubjectId),
+  );
+}
+
+export class SlackBotLifecycleSuccessAuditError extends Error {
+  constructor() {
+    super("OpenGeni Slack bot lifecycle success audit failed");
+    this.name = "SlackBotLifecycleSuccessAuditError";
+  }
+}
+
+type SlackBotLifecycleSuccessAuditInput = {
+  accountId: string;
+  workspaceId: string;
+  subjectId: string;
+  credentialRole: string;
+  credentialLabel: string;
+  slackTeamId: string;
+};
+
+async function insertSlackBotLifecycleSuccessAuditInScope(
+  db: Database,
+  input: SlackBotLifecycleSuccessAuditInput & {
+    action: "slack_bot.connected" | "slack_bot.reinstalled" | "slack_bot.disconnected";
+    connectionId: string;
+  },
+): Promise<void> {
+  try {
+    await db.insert(schema.auditEvents).values({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      action: input.action,
+      targetType: "connection",
+      targetId: input.connectionId,
+      metadata: {
+        credentialRole: input.credentialRole,
+        credentialLabel: input.credentialLabel,
+        connectionId: input.connectionId,
+        slackTeamId: input.slackTeamId,
+        outcome: "succeeded",
+      },
+    });
+  } catch {
+    // Do not leak a provider/database payload through the callback. Throwing from
+    // the RLS transaction is what rolls the paired connection mutation back.
+    throw new SlackBotLifecycleSuccessAuditError();
+  }
+}
+
+async function assertWorkspaceAccountPairInScope(
+  db: Database,
+  accountId: string,
+  workspaceId: string,
+): Promise<void> {
+  const [workspace] = await db
+    .select({ id: schema.workspaces.id })
+    .from(schema.workspaces)
+    .where(and(eq(schema.workspaces.id, workspaceId), eq(schema.workspaces.accountId, accountId)))
+    .limit(1);
+  if (!workspace) {
+    throw new Error("Workspace does not belong to the expected account");
+  }
+}
+
+async function withSlackBotLifecycleRls<T>(
+  db: Database,
+  input: Pick<SlackBotLifecycleSuccessAuditInput, "accountId" | "workspaceId" | "subjectId">,
+  fn: (db: Database) => Promise<T>,
+): Promise<T> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      await setSubjectRlsContext(scopedDb, input.subjectId);
+      await assertWorkspaceAccountPairInScope(scopedDb, input.accountId, input.workspaceId);
+      return await fn(scopedDb);
+    },
+  );
+}
+
+export async function createConnectionWithSlackBotSuccessAudit(
+  db: Database,
+  input: SlackBotLifecycleSuccessAuditInput & { connection: CreateConnectionInput },
+): Promise<ConnectionMetadataWithVerification> {
+  if (
+    input.connection.accountId !== input.accountId ||
+    input.connection.workspaceId !== input.workspaceId
+  ) {
+    throw new Error("Slack bot connection and lifecycle audit tenant must match");
+  }
+  return await withSlackBotLifecycleRls(db, input, async (scopedDb) => {
+    const connection = await createConnectionInScope(scopedDb, input.connection);
+    await insertSlackBotLifecycleSuccessAuditInScope(scopedDb, {
+      ...input,
+      action: "slack_bot.connected",
+      connectionId: connection.id,
+    });
+    return connection;
   });
 }
 
+export async function updateConnectionWithSlackBotSuccessAudit(
+  db: Database,
+  input: SlackBotLifecycleSuccessAuditInput & { connection: UpdateConnectionInput },
+): Promise<ConnectionMetadataWithVerification | null> {
+  if (input.connection.workspaceId !== input.workspaceId) {
+    throw new Error("Slack bot connection and lifecycle audit workspace must match");
+  }
+  return await withSlackBotLifecycleRls(db, input, async (scopedDb) => {
+    const connection = await updateConnectionInScope(scopedDb, input.connection);
+    if (!connection) return null;
+    if (connection.accountId !== input.accountId) {
+      throw new Error("Slack bot connection and lifecycle audit account must match");
+    }
+    await insertSlackBotLifecycleSuccessAuditInScope(scopedDb, {
+      ...input,
+      action: "slack_bot.reinstalled",
+      connectionId: connection.id,
+    });
+    return connection;
+  });
+}
+
+export async function revokeConnectionWithSlackBotSuccessAudit(
+  db: Database,
+  input: SlackBotLifecycleSuccessAuditInput & {
+    connectionId: string;
+    expectedVersion: number;
+  },
+): Promise<ConnectionMetadataWithVerification | null> {
+  return await withSlackBotLifecycleRls(db, input, async (scopedDb) => {
+    const connection = await revokeConnectionInScope(
+      scopedDb,
+      input.workspaceId,
+      input.connectionId,
+      input.subjectId,
+      input.expectedVersion,
+    );
+    if (!connection) return null;
+    if (connection.accountId !== input.accountId) {
+      throw new Error("Slack bot connection and lifecycle audit account must match");
+    }
+    await insertSlackBotLifecycleSuccessAuditInScope(scopedDb, {
+      ...input,
+      action: "slack_bot.disconnected",
+      connectionId: connection.id,
+    });
+    return connection;
+  });
+}
+
+export type SlackBotInstallCallbackFailureStage =
+  | "permission_check"
+  | "nonce_consume"
+  | "provider_denial"
+  | "code_exchange"
+  | "credential_verification"
+  | "permission_recheck"
+  | "principal_validation"
+  | "persistence";
+
+export type SlackBotInstallCallbackFailureReason =
+  | "permission_lost"
+  | "state_replayed"
+  | "provider_denied"
+  | "missing_code"
+  | "exchange_failed"
+  | "scope_mismatch"
+  | "identity_mismatch"
+  | "credential_verification_failed"
+  | "connection_conflict"
+  | "principal_mismatch"
+  | "persistence_failed"
+  | "success_audit_failed";
+
+export async function recordSlackBotInstallCallbackFailure(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    callbackDigest: string;
+    installMode: "connect" | "reinstall";
+    stage: SlackBotInstallCallbackFailureStage;
+    reason: SlackBotInstallCallbackFailureReason;
+  },
+): Promise<boolean> {
+  if (!/^[a-f0-9]{64}$/.test(input.callbackDigest)) {
+    throw new Error("Slack callback digest must be a lowercase SHA-256 value");
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      await setSubjectRlsContext(scopedDb, input.subjectId);
+      await assertWorkspaceAccountPairInScope(scopedDb, input.accountId, input.workspaceId);
+      await scopedDb.execute(
+        sql`select pg_advisory_xact_lock(hashtextextended(${`slack-callback-failure:${input.workspaceId}:${input.callbackDigest}`}, 0))`,
+      );
+      const [existing] = await scopedDb
+        .select({ id: schema.auditEvents.id })
+        .from(schema.auditEvents)
+        .where(
+          and(
+            eq(schema.auditEvents.accountId, input.accountId),
+            eq(schema.auditEvents.workspaceId, input.workspaceId),
+            eq(schema.auditEvents.action, "slack_bot.install.callback.failed"),
+            eq(schema.auditEvents.targetType, "slack_oauth_callback"),
+            eq(schema.auditEvents.targetId, input.callbackDigest),
+          ),
+        )
+        .limit(1);
+      if (existing) return false;
+      await scopedDb.insert(schema.auditEvents).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.subjectId,
+        action: "slack_bot.install.callback.failed",
+        targetType: "slack_oauth_callback",
+        targetId: input.callbackDigest,
+        metadata: {
+          outcome: "failed",
+          installMode: input.installMode,
+          stage: input.stage,
+          reason: input.reason,
+        },
+      });
+      return true;
+    },
+  );
+}
+
 export type ClaimSlackBotPostOperationResult =
   | { kind: "claimed" | "in_progress" | "completed"; operation: SlackBotPostOperation }
   | { kind: "conflict" | "connection_not_found" };
@@ -5215,6 +5515,9 @@ export async function loadConnectionCredentialForBroker(
     allowSubjectOwned?: boolean;
   },
 ): Promise<ConnectionCredentialForBroker | null> {
+  if (input.allowSubjectOwned && !input.subjectId) {
+    return null;
+  }
   const key = environmentsEncryptionKeyBytes(settings);
   if (!key) {
     throw new Error(
@@ -5222,7 +5525,7 @@ export async function loadConnectionCredentialForBroker(
     );
   }
   const subjectPredicate = input.allowSubjectOwned
-    ? connectionSubjectVisibility(input.subjectId)
+    ? connectionExactSubject(input.subjectId)
     : isNull(schema.connections.subjectId);
   const conditions: SQL[] = [
     eq(schema.connections.workspaceId, input.workspaceId),
@@ -5236,49 +5539,54 @@ export async function loadConnectionCredentialForBroker(
       conditions.push(eq(schema.connections.kind, input.kind));
     }
   }
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    // Prefer active rows: a revoke bumps updatedAt, so recency alone would let a
-    // freshly revoked connection shadow an active replacement for the provider.
-    const [row] = await scopedDb
-      .select()
-      .from(schema.connections)
-      .where(and(...conditions))
-      .orderBy(
-        desc(sql`(${schema.connections.status} = 'active')`),
-        desc(schema.connections.updatedAt),
-      )
-      .limit(1);
-    if (!row) {
-      return null;
-    }
-    let credential: unknown;
-    try {
-      credential = JSON.parse(decryptEnvironmentValue(key, row.credentialEncrypted));
-    } catch (error) {
-      throw new Error(
-        `connection credential could not be decrypted for ${row.id}: ${error instanceof Error ? error.message : String(error)}`,
-        { cause: error },
-      );
-    }
-    if (!credential || typeof credential !== "object" || Array.isArray(credential)) {
-      throw new Error(`connection credential bundle for ${row.id} is not a JSON object`);
-    }
-    return {
-      id: row.id,
-      accountId: row.accountId,
-      workspaceId: row.workspaceId,
-      subjectId: row.subjectId,
-      providerDomain: row.providerDomain,
-      kind: row.kind as ConnectionKind,
-      status: row.status as ConnectionStatus,
-      credential: credential as Record<string, unknown>,
-      grantedScopes: row.grantedScopes,
-      expiresAt: row.expiresAt,
-      lastRefreshAt: row.lastRefreshAt,
-      version: row.version,
-      metadata: row.metadata,
-    };
-  });
+  return await withConnectionSubjectRls(
+    db,
+    input.workspaceId,
+    input.allowSubjectOwned ? input.subjectId : null,
+    async (scopedDb) => {
+      // Prefer active rows: a revoke bumps updatedAt, so recency alone would let a
+      // freshly revoked connection shadow an active replacement for the provider.
+      const [row] = await scopedDb
+        .select()
+        .from(schema.connections)
+        .where(and(...conditions))
+        .orderBy(
+          desc(sql`(${schema.connections.status} = 'active')`),
+          desc(schema.connections.updatedAt),
+        )
+        .limit(1);
+      if (!row) {
+        return null;
+      }
+      let credential: unknown;
+      try {
+        credential = JSON.parse(decryptEnvironmentValue(key, row.credentialEncrypted));
+      } catch (error) {
+        throw new Error(
+          `connection credential could not be decrypted for ${row.id}: ${error instanceof Error ? error.message : String(error)}`,
+          { cause: error },
+        );
+      }
+      if (!credential || typeof credential !== "object" || Array.isArray(credential)) {
+        throw new Error(`connection credential bundle for ${row.id} is not a JSON object`);
+      }
+      return {
+        id: row.id,
+        accountId: row.accountId,
+        workspaceId: row.workspaceId,
+        subjectId: row.subjectId,
+        providerDomain: row.providerDomain,
+        kind: row.kind as ConnectionKind,
+        status: row.status as ConnectionStatus,
+        credential: credential as Record<string, unknown>,
+        grantedScopes: row.grantedScopes,
+        expiresAt: row.expiresAt,
+        lastRefreshAt: row.lastRefreshAt,
+        version: row.version,
+        metadata: row.metadata,
+      };
+    },
+  );
 }
 
 export async function recordConnectionTokenRefresh(
@@ -5291,35 +5599,42 @@ export async function recordConnectionTokenRefresh(
     expiresAt: Date | null;
     grantedScopes?: string[];
     lastRefreshAt: Date;
+    subjectId?: string | null;
   },
 ): Promise<boolean> {
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const set = {
-      credentialEncrypted: input.credentialEncrypted,
-      expiresAt: input.expiresAt,
-      lastRefreshAt: input.lastRefreshAt,
-      status: "active",
-      lastError: null,
-      version: sql`${schema.connections.version} + 1`,
-      updatedAt: new Date(),
-      ...(input.grantedScopes !== undefined ? { grantedScopes: input.grantedScopes } : {}),
-    };
-    const updated = await scopedDb
-      .update(schema.connections)
-      .set(set)
-      .where(
-        and(
-          eq(schema.connections.id, input.id),
-          eq(schema.connections.workspaceId, input.workspaceId),
-          eq(schema.connections.version, input.version),
-          // A refresh may only ever renew a live credential; revoked/errored rows
-          // stay dead even if a status change somewhere forgot to bump version.
-          eq(schema.connections.status, "active"),
-        ),
-      )
-      .returning({ id: schema.connections.id });
-    return updated.length > 0;
-  });
+  return await withConnectionSubjectRls(
+    db,
+    input.workspaceId,
+    input.subjectId,
+    async (scopedDb) => {
+      const set = {
+        credentialEncrypted: input.credentialEncrypted,
+        expiresAt: input.expiresAt,
+        lastRefreshAt: input.lastRefreshAt,
+        status: "active",
+        lastError: null,
+        version: sql`${schema.connections.version} + 1`,
+        updatedAt: new Date(),
+        ...(input.grantedScopes !== undefined ? { grantedScopes: input.grantedScopes } : {}),
+      };
+      const updated = await scopedDb
+        .update(schema.connections)
+        .set(set)
+        .where(
+          and(
+            eq(schema.connections.id, input.id),
+            eq(schema.connections.workspaceId, input.workspaceId),
+            eq(schema.connections.version, input.version),
+            connectionExactSubject(input.subjectId),
+            // A refresh may only ever renew a live credential; revoked/errored rows
+            // stay dead even if a status change somewhere forgot to bump version.
+            eq(schema.connections.status, "active"),
+          ),
+        )
+        .returning({ id: schema.connections.id });
+      return updated.length > 0;
+    },
+  );
 }
 
 export async function setConnectionStatus(
@@ -5327,9 +5642,9 @@ export async function setConnectionStatus(
   workspaceId: string,
   status: ConnectionStatus,
   lastError: string | null,
-  guard: { id: string; version: number },
+  guard: { id: string; version: number; subjectId?: string | null },
 ): Promise<boolean> {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withConnectionSubjectRls(db, workspaceId, guard.subjectId, async (scopedDb) => {
     const updated = await scopedDb
       .update(schema.connections)
       .set({
@@ -5347,6 +5662,7 @@ export async function setConnectionStatus(
           eq(schema.connections.workspaceId, workspaceId),
           eq(schema.connections.id, guard.id),
           eq(schema.connections.version, guard.version),
+          connectionExactSubject(guard.subjectId),
         ),
       )
       .returning({ id: schema.connections.id });
@@ -5358,8 +5674,9 @@ export async function recordConnectionUsed(
   db: Database,
   workspaceId: string,
   connectionId: string,
+  subjectId?: string | null,
 ): Promise<void> {
-  await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  await withConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     await scopedDb
       .update(schema.connections)
       .set({
@@ -5370,6 +5687,7 @@ export async function recordConnectionUsed(
         and(
           eq(schema.connections.workspaceId, workspaceId),
           eq(schema.connections.id, connectionId),
+          connectionExactSubject(subjectId),
         ),
       );
   });
@@ -13559,6 +13877,7 @@ export type SessionCreateInput = {
   initialMessage: string;
   initialTurnInstructions?: string | null;
   resources: ResourceRef[];
+  skills?: SessionSkill[];
   tools?: ToolRef[];
   toolPolicy?: SessionToolPolicy | null;
   metadata: Record<string, unknown>;
@@ -13571,6 +13890,7 @@ export type SessionCreateInput = {
   rigId?: string | null;
   rigVersionId?: string | null;
   firstPartyMcpPermissions?: Permission[] | null;
+  firstPartyMcpTools?: FirstPartyMcpToolName[] | null;
   instructions?: string | null;
   parentSessionId?: string | null;
   createIdempotencyKey?: string | null;
@@ -13958,6 +14278,7 @@ async function createSessionInTransaction(
       initialMessage: input.initialMessage,
       initialTurnInstructions: input.initialTurnInstructions ?? null,
       resources: input.resources,
+      skills: input.skills ?? [],
       tools: input.tools ?? [],
       toolPolicy: input.toolPolicy ?? null,
       metadata: input.metadata,
@@ -13970,6 +14291,7 @@ async function createSessionInTransaction(
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools ?? null,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey,
@@ -15971,13 +16293,16 @@ type LineageIdRow = {
   parentSessionId: string | null;
   depth: number;
   path: string[];
+  cycle: boolean;
 };
 
 /**
  * Read the full lineage slice around a session. Every recursive step carries
  * workspace_id as a hard predicate; a foreign parent/child id is invisible even
- * before RLS is considered. Ancestors are capped at 10 and returned root-first.
- * Descendants are capped at depth 5 and 200 total rows, returned as a nested tree.
+ * before RLS is considered. Up to 63 ancestors are returned root-first; an
+ * invalid, cyclic, foreign, or deeper chain fails closed instead of presenting
+ * a partial path as if it were rooted. Descendants are capped at depth 5 and
+ * 200 total rows, returned as a nested tree.
  */
 export async function getSessionLineage(
   db: Database,
@@ -15999,25 +16324,39 @@ export async function getSessionLineage(
       return null;
     }
 
-    const ancestorRows = (await scopedDb.execute(sql<LineageIdRow>`
-      with recursive ancestors(id, parent_session_id, depth, path) as (
-        select ${schema.sessions.id}, ${schema.sessions.parentSessionId}, 0, array[${schema.sessions.id}]
+    const ancestorLineageRows = (await scopedDb.execute(sql<LineageIdRow>`
+      with recursive ancestors(id, parent_session_id, depth, path, cycle) as (
+        select ${schema.sessions.id}, ${schema.sessions.parentSessionId}, 0, array[${schema.sessions.id}], false
         from ${schema.sessions}
         where ${schema.sessions.workspaceId} = ${workspaceId}
           and ${schema.sessions.id} = ${sessionId}
         union all
-        select parent.id, parent.parent_session_id, ancestors.depth + 1, ancestors.path || parent.id
+        select
+          parent.id,
+          parent.parent_session_id,
+          ancestors.depth + 1,
+          ancestors.path || parent.id,
+          parent.id = any(ancestors.path)
         from ${schema.sessions} parent
         join ancestors on ancestors.parent_session_id = parent.id
         where parent.workspace_id = ${workspaceId}
-          and ancestors.depth < 10
-          and not parent.id = any(ancestors.path)
+          and not ancestors.cycle
+          and ancestors.depth < 64
       )
-      select id, parent_session_id as "parentSessionId", depth, path
+      select id, parent_session_id as "parentSessionId", depth, path, cycle
       from ancestors
-      where depth > 0
       order by depth desc
     `)) as LineageIdRow[];
+    const frontier = ancestorLineageRows[0];
+    if (
+      !frontier ||
+      frontier.cycle ||
+      frontier.parentSessionId !== null ||
+      Number(frontier.depth) >= 64
+    ) {
+      throw new Error(`session lineage for ${sessionId} has no valid workspace root`);
+    }
+    const ancestorRows = ancestorLineageRows.filter((row) => row.depth > 0);
 
     const childRows = (await scopedDb.execute(sql<LineageIdRow>`
       with recursive descendants(id, parent_session_id, depth, path) as (
@@ -16033,7 +16372,7 @@ export async function getSessionLineage(
           and descendants.depth < 5
           and not child.id = any(descendants.path)
       )
-      select id, parent_session_id as "parentSessionId", depth, path
+      select id, parent_session_id as "parentSessionId", depth, path, false as cycle
       from descendants
       order by path
       limit ${descendantLimit + 1}
@@ -28650,7 +28989,7 @@ export async function materializeGoalContinuation(
               eq(schema.sessionSystemUpdates.workspaceId, input.workspaceId),
               eq(schema.sessionSystemUpdates.sessionId, input.sessionId),
               eq(schema.sessionSystemUpdates.kind, "agent_steer_instruction"),
-              inArray(schema.sessionSystemUpdates.state, ["pending", "deferred"]),
+              eq(schema.sessionSystemUpdates.state, "pending"),
             ),
           )
           .limit(1);
@@ -28813,6 +29152,7 @@ export async function materializeGoalContinuation(
           })
           .onConflictDoNothing({ target: schema.usageEvents.idempotencyKey });
 
+        const eventPreview = internalUpdateEventMember(update);
         const insertedEvents = await tx
           .insert(schema.sessionEvents)
           .values([
@@ -28823,11 +29163,13 @@ export async function materializeGoalContinuation(
               sequence: session.lastSequence + 1,
               type: "system.update.pending",
               payload: sanitizeEventPayload({
-                updateId: update.id,
-                kind: update.kind,
-                classification: update.classification,
-                sourceId: update.sourceId,
-                summary: update.summary,
+                updateId: eventPreview.id,
+                kind: eventPreview.kind,
+                classification: eventPreview.classification,
+                sourceId: eventPreview.sourceId,
+                sourceIdTruncated: eventPreview.sourceIdTruncated,
+                summary: eventPreview.summary,
+                summaryTruncated: eventPreview.summaryTruncated,
               }),
               occurredAt: now,
             },
@@ -29328,6 +29670,79 @@ export type SessionWorkTrigger = { kind: "next" } | { kind: "approval"; triggerE
 export const MAX_INTERNAL_UPDATE_BYTES = 64 * 1024;
 export const MAX_INTERNAL_UPDATE_BATCH_MEMBERS = 100;
 export const MAX_INTERNAL_UPDATE_BATCH_BYTES = 256 * 1024;
+const MAX_INTERNAL_UPDATE_EVENT_SUMMARY_BYTES = 512;
+const MAX_INTERNAL_UPDATE_EVENT_SOURCE_BYTES = 256;
+
+type BoundedSystemUpdate = Pick<
+  typeof schema.sessionSystemUpdates.$inferSelect,
+  "id" | "kind" | "classification" | "sourceId" | "summary" | "payload" | "lineage"
+>;
+
+function boundedInternalUpdateEventText(
+  value: string,
+  maxBytes: number,
+): {
+  text: string;
+  truncated: boolean;
+} {
+  if (Buffer.byteLength(value) <= maxBytes) return { text: value, truncated: false };
+  const suffix = "…";
+  const bodyBudget = maxBytes - Buffer.byteLength(suffix);
+  const bytes = Buffer.from(value);
+  let text = bytes.subarray(0, bodyBudget).toString("utf8");
+  if (text.endsWith("\uFFFD")) text = text.slice(0, -1);
+  return { text: `${text}${suffix}`, truncated: true };
+}
+
+function internalUpdateEventMember(update: BoundedSystemUpdate) {
+  const summary = boundedInternalUpdateEventText(
+    update.summary,
+    MAX_INTERNAL_UPDATE_EVENT_SUMMARY_BYTES,
+  );
+  const source = boundedInternalUpdateEventText(
+    update.sourceId,
+    MAX_INTERNAL_UPDATE_EVENT_SOURCE_BYTES,
+  );
+  return {
+    id: update.id,
+    kind: update.kind,
+    classification: update.classification,
+    sourceId: source.text,
+    sourceIdTruncated: source.truncated,
+    summary: summary.text,
+    summaryTruncated: summary.truncated,
+  };
+}
+
+function selectBoundedSystemUpdateBatch<T extends BoundedSystemUpdate>(updates: readonly T[]): T[] {
+  const selected: T[] = [];
+  let selectedBytes = 0;
+  for (const update of updates) {
+    const updateBytes = Buffer.byteLength(
+      JSON.stringify({
+        id: update.id,
+        kind: update.kind,
+        classification: update.classification,
+        sourceId: update.sourceId,
+        summary: update.summary,
+        payload: update.payload,
+        lineage: update.lineage,
+      }),
+    );
+    if (
+      selected.length >= MAX_INTERNAL_UPDATE_BATCH_MEMBERS ||
+      // One individually large canonical input must still make progress. The
+      // model/context boundary may reject it explicitly, but the queue cannot
+      // wedge forever merely because the coalescing target is smaller.
+      (selected.length > 0 && selectedBytes + updateBytes > MAX_INTERNAL_UPDATE_BATCH_BYTES)
+    ) {
+      break;
+    }
+    selected.push(update);
+    selectedBytes += updateBytes;
+  }
+  return selected;
+}
 
 export type ClaimSessionWorkForAttemptInput = {
   sessionId: string;
@@ -29373,7 +29788,10 @@ export async function claimSessionWorkForAttempt(
           count: number;
           lastSequence: number;
           triggerEventId: string | null;
+          historyItemId: string | null;
+          historyItem: Record<string, unknown> | null;
           updates: Array<typeof schema.sessionSystemUpdates.$inferSelect>;
+          events: Array<typeof schema.sessionEvents.$inferInsert>;
           event: typeof schema.sessionEvents.$inferInsert | null;
         }> => {
           const [agentSteer] = await tx
@@ -29383,7 +29801,7 @@ export async function claimSessionWorkForAttempt(
               and(
                 eq(schema.sessionSystemUpdates.workspaceId, workspaceId),
                 eq(schema.sessionSystemUpdates.sessionId, sessionId),
-                inArray(schema.sessionSystemUpdates.state, ["pending", "deferred"]),
+                eq(schema.sessionSystemUpdates.state, "pending"),
                 eq(schema.sessionSystemUpdates.kind, "agent_steer_instruction"),
               ),
             )
@@ -29393,20 +29811,6 @@ export async function claimSessionWorkForAttempt(
             )
             .limit(1)
             .for("update");
-          if (agentSteer) {
-            await tx
-              .update(schema.sessionSystemUpdates)
-              .set({ state: "superseded" })
-              .where(
-                and(
-                  eq(schema.sessionSystemUpdates.workspaceId, workspaceId),
-                  eq(schema.sessionSystemUpdates.sessionId, sessionId),
-                  eq(schema.sessionSystemUpdates.kind, "agent_steer_instruction"),
-                  inArray(schema.sessionSystemUpdates.state, ["pending", "deferred"]),
-                  ne(schema.sessionSystemUpdates.id, agentSteer.id),
-                ),
-              );
-          }
           const ordinary = await tx
             .select()
             .from(schema.sessionSystemUpdates)
@@ -29414,7 +29818,7 @@ export async function claimSessionWorkForAttempt(
               and(
                 eq(schema.sessionSystemUpdates.workspaceId, workspaceId),
                 eq(schema.sessionSystemUpdates.sessionId, sessionId),
-                inArray(schema.sessionSystemUpdates.state, ["pending", "deferred"]),
+                eq(schema.sessionSystemUpdates.state, "pending"),
                 ne(schema.sessionSystemUpdates.kind, "agent_steer_instruction"),
               ),
             )
@@ -29430,12 +29834,15 @@ export async function claimSessionWorkForAttempt(
               count: 0,
               lastSequence: nextSequence - 1,
               triggerEventId: null,
+              historyItemId: null,
+              historyItem: null,
               updates: [],
+              events: [],
               event: null,
             };
           }
-          const deliverable: typeof updates = [];
-          let deliveredBytes = 0;
+          const validUpdates: typeof updates = [];
+          const cancelledUpdateIds: string[] = [];
           for (const update of updates) {
             const payload = update.payload;
             if (payload.type === "goal_continuation") {
@@ -29464,43 +29871,66 @@ export async function claimSessionWorkForAttempt(
                   .update(schema.sessionSystemUpdates)
                   .set({ state: "cancelled" })
                   .where(eq(schema.sessionSystemUpdates.id, update.id));
+                cancelledUpdateIds.push(update.id);
                 continue;
               }
             }
-            const updateBytes = Buffer.byteLength(
-              JSON.stringify({
-                id: update.id,
-                kind: update.kind,
-                classification: update.classification,
-                sourceId: update.sourceId,
-                summary: update.summary,
-                payload: update.payload,
-                lineage: update.lineage,
-              }),
-            );
-            if (
-              deliverable.length >= MAX_INTERNAL_UPDATE_BATCH_MEMBERS ||
-              deliveredBytes + updateBytes > MAX_INTERNAL_UPDATE_BATCH_BYTES
-            ) {
-              break;
-            }
-            deliverable.push(update);
-            deliveredBytes += updateBytes;
+            validUpdates.push(update);
           }
+          const deliverable = selectBoundedSystemUpdateBatch(validUpdates);
           if (deliverable.length === 0) {
+            const cancellationEvent =
+              cancelledUpdateIds.length > 0
+                ? {
+                    accountId,
+                    workspaceId,
+                    sessionId,
+                    // No receiving turn exists when every candidate was
+                    // cancelled before a model batch could be persisted.
+                    turnId: null,
+                    turnGeneration: null,
+                    turnAttemptId: null,
+                    turnAssociation: null,
+                    sequence: nextSequence,
+                    type: "system.update.cancelled" as const,
+                    payload: sanitizeEventPayload({
+                      updateIds: cancelledUpdateIds,
+                      count: cancelledUpdateIds.length,
+                      reason: "stale_goal_continuation",
+                    }),
+                    occurredAt,
+                  }
+                : null;
             return {
               count: 0,
-              lastSequence: nextSequence - 1,
+              lastSequence: cancellationEvent ? nextSequence : nextSequence - 1,
               triggerEventId: null,
+              historyItemId: null,
+              historyItem: null,
               updates: [],
+              events: cancellationEvent ? [cancellationEvent] : [],
               event: null,
             };
           }
+          // Inclusion gives the newest Steer first refusal on the bounded
+          // batch. Model ordering is deliberately the opposite: ordinary
+          // updates establish context, then the authoritative replacement
+          // direction is last so it cannot be overridden by an older goal or
+          // lifecycle notice.
+          const modelOrdered = [
+            ...deliverable.filter((update) => update.kind !== "agent_steer_instruction"),
+            ...deliverable.filter((update) => update.kind === "agent_steer_instruction"),
+          ];
+          const historyItemId = crypto.randomUUID();
+          const historyItem = sessionSystemUpdateBatchHistoryItem(
+            modelOrdered.map((update) => mapSessionSystemUpdate(update)),
+          ) as Record<string, unknown>;
           await tx
             .update(schema.sessionSystemUpdates)
             .set({
               state: "delivered",
               deliveredTurnId: turnId,
+              deliveredHistoryItemId: historyItemId,
               deliveredAt: occurredAt,
             })
             .where(
@@ -29514,6 +29944,27 @@ export async function claimSessionWorkForAttempt(
               ),
             );
           const eventId = triggerEventId ?? crypto.randomUUID();
+          let sequence = nextSequence - 1;
+          const events: Array<typeof schema.sessionEvents.$inferInsert> = [];
+          if (cancelledUpdateIds.length > 0) {
+            events.push({
+              accountId,
+              workspaceId,
+              sessionId,
+              turnId,
+              turnGeneration,
+              turnAttemptId: input.attemptId,
+              turnAssociation: "current",
+              sequence: ++sequence,
+              type: "system.update.cancelled",
+              payload: sanitizeEventPayload({
+                updateIds: cancelledUpdateIds,
+                count: cancelledUpdateIds.length,
+                reason: "stale_goal_continuation",
+              }),
+              occurredAt,
+            });
+          }
           const event: typeof schema.sessionEvents.$inferInsert = {
             id: eventId,
             accountId,
@@ -29523,24 +29974,64 @@ export async function claimSessionWorkForAttempt(
             turnGeneration,
             turnAttemptId: input.attemptId,
             turnAssociation: "current",
-            sequence: nextSequence,
+            sequence: ++sequence,
             type: "system.update.delivered",
             payload: sanitizeEventPayload({
               updateIds: deliverable.map((update) => update.id),
+              historyItemId,
               count: deliverable.length,
               classifications: [...new Set(deliverable.map((update) => update.classification))],
+              members: modelOrdered.map(internalUpdateEventMember),
             }),
             occurredAt,
           };
+          events.push(event);
           return {
             count: deliverable.length,
-            lastSequence: nextSequence,
+            lastSequence: sequence,
             triggerEventId: eventId,
+            historyItemId,
+            historyItem,
             updates: deliverable,
+            events,
             event,
           };
         };
 
+        const persistDeliveredUpdateBatch = async (
+          delivered: Awaited<ReturnType<typeof deliverPendingUpdates>>,
+          accountId: string,
+          turnId: string,
+        ): Promise<void> => {
+          if (!delivered.historyItemId || !delivered.historyItem) {
+            if (delivered.count !== 0) {
+              throw new Error("Delivered machine-input batch has no model-memory item");
+            }
+            return;
+          }
+          const [{ position } = { position: 0 }] = await tx
+            .select({
+              position: sql<number>`coalesce(max(${schema.sessionHistoryItems.position}), -1) + 1`,
+            })
+            .from(schema.sessionHistoryItems)
+            .where(
+              and(
+                eq(schema.sessionHistoryItems.workspaceId, workspaceId),
+                eq(schema.sessionHistoryItems.sessionId, sessionId),
+              ),
+            );
+          await tx.insert(schema.sessionHistoryItems).values({
+            id: delivered.historyItemId,
+            accountId,
+            workspaceId,
+            sessionId,
+            turnId,
+            position: Number(position),
+            item: sanitizeModelPayload(delivered.historyItem),
+            producerCodexCredentialId: null,
+          });
+        };
+
         // Capacity settlement and resume use session -> turn after their
         // workspace rotation lock. Claiming must preserve that shared order:
         // taking a queued turn first can deadlock with a settlement that owns
@@ -29588,6 +30079,12 @@ export async function claimSessionWorkForAttempt(
             and(
               eq(schema.sessionAttemptInterruptions.workspaceId, workspaceId),
               eq(schema.sessionAttemptInterruptions.sessionId, sessionId),
+              inArray(schema.sessionAttemptInterruptions.state, [
+                "pending",
+                "delivered",
+                "acknowledged",
+                "settled",
+              ]),
               isNull(schema.sessionTurnAttempts.quiescedAt),
             ),
           )
@@ -29870,7 +30367,7 @@ export async function claimSessionWorkForAttempt(
               eq(schema.sessionSystemUpdates.workspaceId, workspaceId),
               eq(schema.sessionSystemUpdates.sessionId, sessionId),
               eq(schema.sessionSystemUpdates.kind, "agent_steer_instruction"),
-              inArray(schema.sessionSystemUpdates.state, ["pending", "deferred"]),
+              eq(schema.sessionSystemUpdates.state, "pending"),
             ),
           )
           .orderBy(
@@ -29879,20 +30376,27 @@ export async function claimSessionWorkForAttempt(
           )
           .limit(1)
           .for("update");
-        const rows = pendingAgentSteer
-          ? []
-          : await rawRows<{
-              id: string;
-              trigger_event_id: string;
-              metadata: Record<string, unknown>;
-            }>(
-              tx as unknown as Database,
-              sql`select id, trigger_event_id, metadata from session_turns
+        // A human/API Steer is the newest explicit replacement direction. It
+        // must claim next even when an older Agent Steer is pending; the
+        // internal instruction is delivered as context on that same human turn
+        // instead of manufacturing another system inference ahead of it.
+        // Ordinary queued sends retain the established Agent-Steer priority.
+        const rows = await rawRows<{
+          id: string;
+          trigger_event_id: string;
+          metadata: Record<string, unknown>;
+        }>(
+          tx as unknown as Database,
+          sql`select id, trigger_event_id, metadata from session_turns
               where workspace_id = ${workspaceId} and session_id = ${sessionId}
                 and status = 'queued' and source in ('user', 'api')
+                and (
+                  ${Boolean(pendingAgentSteer)} = false
+                  or metadata->>'delivery' = 'steer'
+                )
               order by position asc, created_at asc, id asc
               limit 1`,
-            );
+        );
         const queuedTurnPreview = rows[0];
         const queuedLocks = queuedTurnPreview
           ? await lockSessionEventWriteRows(tx as unknown as Database, {
@@ -30100,6 +30604,22 @@ export async function claimSessionWorkForAttempt(
             triggerEventId,
           );
           if (delivered.count === 0) {
+            if (delivered.events.length > 0) {
+              await tx.insert(schema.sessionEvents).values(delivered.events);
+              await tx
+                .update(schema.sessions)
+                .set({
+                  status: "idle",
+                  lastSequence: delivered.lastSequence,
+                  updatedAt: now,
+                })
+                .where(
+                  and(
+                    eq(schema.sessions.workspaceId, workspaceId),
+                    eq(schema.sessions.id, sessionId),
+                  ),
+                );
+            }
             return { action: "unclaimed", reason: "no-work" };
           }
           const goalUpdate = delivered.updates.find(
@@ -30286,9 +30806,10 @@ export async function claimSessionWorkForAttempt(
             })
             .returning();
           if (!internalTurn) throw new Error("Failed to create internal update inference");
+          await persistDeliveredUpdateBatch(delivered, session.accountId, internalTurn.id);
           await registerAttempt(internalTurn);
           if (!delivered.event) throw new Error("Delivered update batch has no durable event");
-          await tx.insert(schema.sessionEvents).values(delivered.event);
+          await tx.insert(schema.sessionEvents).values(delivered.events);
           if (goalUpdate && typeof goalUpdate.payload.goalId === "string") {
             await tx
               .update(schema.sessionGoals)
@@ -30405,8 +30926,9 @@ export async function claimSessionWorkForAttempt(
           session.lastSequence + 1,
           now,
         );
-        if (delivered.event) {
-          await tx.insert(schema.sessionEvents).values(delivered.event);
+        await persistDeliveredUpdateBatch(delivered, session.accountId, row.id);
+        if (delivered.events.length > 0) {
+          await tx.insert(schema.sessionEvents).values(delivered.events);
         }
         await tx
           .update(schema.sessions)
@@ -30650,6 +31172,196 @@ export async function markSessionAttemptQuiesced(
   });
 }
 
+export type ReconcileSessionAttemptQuiescenceResult =
+  | { action: "quiesced"; events: SessionEvent[] }
+  | { action: "pending"; events: [] }
+  | { action: "stale"; events: [] };
+
+export type SessionAttemptActivityRef = {
+  workflowId: string;
+  workflowRunId: string;
+  activityId: string;
+  quiesced: boolean;
+};
+
+export async function getSessionAttemptActivityRef(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    attemptId: string;
+    temporalWorkflowId: string;
+  },
+): Promise<SessionAttemptActivityRef | null> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const [attempt] = await scopedDb
+        .select({
+          workflowId: schema.sessionTurnAttempts.temporalWorkflowId,
+          workflowRunId: schema.sessionTurnAttempts.temporalWorkflowRunId,
+          activityId: schema.sessionTurnAttempts.temporalActivityId,
+          quiescedAt: schema.sessionTurnAttempts.quiescedAt,
+        })
+        .from(schema.sessionTurnAttempts)
+        .where(
+          and(
+            eq(schema.sessionTurnAttempts.accountId, input.accountId),
+            eq(schema.sessionTurnAttempts.workspaceId, input.workspaceId),
+            eq(schema.sessionTurnAttempts.sessionId, input.sessionId),
+            eq(schema.sessionTurnAttempts.id, input.attemptId),
+            eq(schema.sessionTurnAttempts.temporalWorkflowId, input.temporalWorkflowId),
+          ),
+        )
+        .limit(1);
+      return attempt
+        ? {
+            workflowId: attempt.workflowId,
+            workflowRunId: attempt.workflowRunId,
+            activityId: attempt.activityId,
+            quiesced: attempt.quiescedAt !== null,
+          }
+        : null;
+    },
+  );
+}
+
+/**
+ * Recover the quiescence receipt when the original activity disappeared after
+ * its attempt was durably interrupted. The caller first proves through
+ * Temporal that the exact activity is absent or its server-owned heartbeat
+ * lease expired. The closed attempt then cannot admit another workspace writer,
+ * and every writer it did admit (including retained-process child writes) must
+ * carry a physical settlement before the ordinary receipt transaction is
+ * allowed to run.
+ */
+export async function reconcileSessionAttemptQuiescence(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    attemptId: string;
+    temporalWorkflowId: string;
+    temporalWorkflowRunId: string;
+    temporalActivityId: string;
+    activitySettled: boolean;
+  },
+): Promise<ReconcileSessionAttemptQuiescenceResult> {
+  const eligibility = await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const rows = await scopedDb.execute<{
+        account_id: string;
+        state: string;
+        quiesced_at: Date | string | null;
+        temporal_workflow_id: string;
+        temporal_workflow_run_id: string;
+        temporal_activity_id: string;
+        interruption_settled: boolean;
+        interruption_pending: boolean;
+        writer_pending: boolean;
+      }>(sql`
+        select
+          attempt.account_id,
+          attempt.state,
+          attempt.quiesced_at,
+          attempt.temporal_workflow_id,
+          attempt.temporal_workflow_run_id,
+          attempt.temporal_activity_id,
+          exists (
+            select 1
+            from session_attempt_interruptions interruption
+            where interruption.workspace_id = attempt.workspace_id
+              and interruption.session_id = attempt.session_id
+              and interruption.attempt_id = attempt.id
+              and interruption.state in ('settled', 'rejected_stale')
+          ) as interruption_settled,
+          exists (
+            select 1
+            from session_attempt_interruptions interruption
+            where interruption.workspace_id = attempt.workspace_id
+              and interruption.session_id = attempt.session_id
+              and interruption.attempt_id = attempt.id
+              and interruption.state in ('pending', 'delivered', 'acknowledged')
+          ) as interruption_pending,
+          (
+            exists (
+              select 1
+              from sandbox_workspace_mutation_admissions admission
+              where admission.account_id = attempt.account_id
+                and admission.workspace_id = attempt.workspace_id
+                and admission.session_id = attempt.session_id
+                and admission.settled_at is null
+                and (
+                  admission.attempt_id = attempt.id
+                  or (
+                    admission.actor_kind = 'process'
+                    and exists (
+                      select 1
+                      from sandbox_retained_processes process
+                      where process.account_id = attempt.account_id
+                        and process.workspace_id = attempt.workspace_id
+                        and process.session_id = attempt.session_id
+                        and process.id = admission.actor_id
+                        and process.owner_attempt_id = attempt.id
+                    )
+                  )
+                )
+            )
+            or exists (
+              select 1
+              from sandbox_retained_processes process
+              where process.account_id = attempt.account_id
+                and process.workspace_id = attempt.workspace_id
+                and process.session_id = attempt.session_id
+                and process.owner_attempt_id = attempt.id
+                and process.state = 'active'
+            )
+          ) as writer_pending
+        from session_turn_attempts attempt
+        where attempt.account_id = ${input.accountId}
+          and attempt.workspace_id = ${input.workspaceId}
+          and attempt.session_id = ${input.sessionId}
+          and attempt.id = ${input.attemptId}
+        limit 1
+      `);
+      return rows[0] ?? null;
+    },
+  );
+  if (
+    !eligibility ||
+    eligibility.account_id !== input.accountId ||
+    eligibility.temporal_workflow_id !== input.temporalWorkflowId ||
+    eligibility.temporal_workflow_run_id !== input.temporalWorkflowRunId ||
+    eligibility.temporal_activity_id !== input.temporalActivityId ||
+    eligibility.state !== "closed" ||
+    !eligibility.interruption_settled ||
+    eligibility.interruption_pending
+  ) {
+    return { action: "stale", events: [] };
+  }
+  if (eligibility.quiesced_at) {
+    return { action: "quiesced", events: [] };
+  }
+  if (!input.activitySettled || eligibility.writer_pending) {
+    return { action: "pending", events: [] };
+  }
+  const events = await markSessionAttemptQuiesced(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    sessionId: input.sessionId,
+    attemptId: input.attemptId,
+    temporalWorkflowId: input.temporalWorkflowId,
+    temporalWorkflowRunId: input.temporalWorkflowRunId,
+    temporalActivityId: input.temporalActivityId,
+  });
+  return { action: "quiesced", events };
+}
+
 /**
  * Settle every durable interruption cause for one exact first-class attempt.
  * Steer wins the logical-turn fate when causes coexist; effective control after
@@ -30820,13 +31532,6 @@ export async function settleSessionAttemptInterruptions(
         outcome,
         closedAt: now,
       });
-      await requeueInterruptedSessionSystemUpdatesForTurnTx(
-        tx as unknown as Database,
-        workspaceId,
-        sessionId,
-        turn.id,
-      );
-
       const eventValues: Array<typeof schema.sessionEvents.$inferInsert> = steer
         ? [
             {
@@ -32111,10 +32816,45 @@ export async function applySessionTurnSettlement(
           },
         }),
       );
+      const settledMachineInputs = ["completed", "failed", "cancelled", "superseded"].includes(
+        input.turnStatus,
+      )
+        ? await tx
+            .select({
+              id: schema.sessionSystemUpdates.id,
+              historyItemId: schema.sessionSystemUpdates.deliveredHistoryItemId,
+            })
+            .from(schema.sessionSystemUpdates)
+            .where(
+              and(
+                eq(schema.sessionSystemUpdates.workspaceId, workspaceId),
+                eq(schema.sessionSystemUpdates.sessionId, input.sessionId),
+                eq(schema.sessionSystemUpdates.deliveredTurnId, input.turnId),
+                eq(schema.sessionSystemUpdates.state, "delivered"),
+              ),
+            )
+            .orderBy(
+              asc(schema.sessionSystemUpdates.createdAt),
+              asc(schema.sessionSystemUpdates.id),
+            )
+        : [];
+      const machineInputSettlementEvent: AppendEventInput | null =
+        settledMachineInputs.length > 0
+          ? {
+              type: "system.update.settled",
+              payload: {
+                updateIds: settledMachineInputs.map((update) => update.id),
+                count: settledMachineInputs.length,
+                historyItemId: settledMachineInputs[0]!.historyItemId,
+                outcome: input.turnStatus,
+              },
+            }
+          : null;
       const settlementEvents = [
         ...(recordingEvent ? [recordingEvent] : []),
         ...(compactionRequestEvent ? [compactionRequestEvent] : []),
         ...terminalHumanInputEvents,
+        ...(machineInputSettlementEvent ? [machineInputSettlementEvent] : []),
         ...input.events,
       ];
       const values = settlementEvents.map((event) => {
@@ -32197,21 +32937,6 @@ export async function applySessionTurnSettlement(
           turn,
         );
       }
-      if (input.turnStatus === "failed") {
-        await deferFailedSessionSystemUpdatesForTurnTx(
-          tx as unknown as Database,
-          workspaceId,
-          input.sessionId,
-          input.turnId,
-        );
-      } else if (["cancelled", "superseded"].includes(input.turnStatus)) {
-        await requeueInterruptedSessionSystemUpdatesForTurnTx(
-          tx as unknown as Database,
-          workspaceId,
-          input.sessionId,
-          input.turnId,
-        );
-      }
       await tx
         .update(schema.sessions)
         .set({
@@ -32495,14 +33220,6 @@ export async function settleCodexCredentialLeaseLoss(
               eq(schema.sessions.activeTurnId, input.turnId),
             ),
           );
-        if (!input.checkpointDurable) {
-          await deferFailedSessionSystemUpdatesForTurnTx(
-            tx as unknown as Database,
-            input.workspaceId,
-            input.sessionId,
-            input.turnId,
-          );
-        }
         await tx.execute(sql`
           delete from codex_credential_leases
           where account_id = ${input.accountId}
@@ -33446,17 +34163,61 @@ export async function getSessionQueueSnapshot(
         ),
       )
       .orderBy(asc(schema.sessionTurns.position), asc(schema.sessionTurns.createdAt));
+    const pendingInputs = await scopedDb
+      .select()
+      .from(schema.sessionSystemUpdates)
+      .where(
+        and(
+          eq(schema.sessionSystemUpdates.workspaceId, workspaceId),
+          eq(schema.sessionSystemUpdates.sessionId, sessionId),
+          eq(schema.sessionSystemUpdates.state, "pending"),
+        ),
+      )
+      .orderBy(
+        sql`case when ${schema.sessionSystemUpdates.kind} = 'agent_steer_instruction' then 0 else 1 end`,
+        asc(schema.sessionSystemUpdates.createdAt),
+        asc(schema.sessionSystemUpdates.id),
+      );
     const latestInterruption = await latestSessionAttemptInterruption(
       scopedDb,
       workspaceId,
       sessionId,
     );
+    const items = rows.map(mapSessionTurn);
+    const nextInputBatch = selectBoundedSystemUpdateBatch(pendingInputs);
+    const hasPendingAgentSteer = pendingInputs.some(
+      (update) => update.kind === "agent_steer_instruction",
+    );
+    const attachmentTurn = hasPendingAgentSteer
+      ? items.find((turn) => turn.metadata.delivery === "steer")
+      : items[0];
     return {
       version: session.queueVersion,
       effectiveControl: serializeEffectiveSessionControl(effectiveControl),
       stoppingPreviousAttempt:
-        latestInterruption !== null && latestInterruption.quiescedAt === null,
-      items: rows.map(mapSessionTurn),
+        latestInterruption !== null &&
+        latestInterruption.interruptionState !== "rejected_stale" &&
+        latestInterruption.quiescedAt === null,
+      items,
+      pendingInputs: pendingInputs.map((update) => {
+        const canonical = mapSessionSystemUpdate(update);
+        return {
+          id: canonical.id,
+          sessionId: canonical.sessionId,
+          kind: canonical.kind,
+          classification: canonical.classification,
+          sourceId: boundedInternalUpdateEventText(canonical.sourceId, 256).text,
+          summary: boundedInternalUpdateEventText(canonical.summary, 512).text,
+          createdAt: canonical.createdAt,
+        };
+      }),
+      pendingInputAttachment:
+        attachmentTurn && nextInputBatch.length > 0
+          ? {
+              turnId: attachmentTurn.id,
+              inputIds: nextInputBatch.map((update) => update.id),
+            }
+          : null,
     };
   });
 }
@@ -33805,12 +34566,13 @@ export async function claimPendingSessionWorkflowWakes(
 
 /**
  * Acknowledge an immediate post-commit signal only after it cannot strand an
- * accepted Agent Steer. Temporal accepting a signal is transport evidence, not
- * proof that a closing workflow observed Postgres or admitted its pending
- * direction. While active control still has an actionable Agent Steer, retain
- * the revision so the bounded outbox dispatcher retries signalWithStart. The
- * attempt-fenced claim consumes the update once; a real Pause is the typed
- * blocker and may acknowledge this revision because Resume commits a new one.
+ * accepted direction or an interrupted attempt awaiting writer-set proof.
+ * Temporal accepting a signal is transport evidence, not proof that a closing
+ * workflow observed Postgres. While active control still has an actionable
+ * Agent Steer or pending quiescence, retain the revision so the bounded outbox
+ * dispatcher retries signalWithStart. The attempt-fenced claim consumes an
+ * Agent Steer once; a real Pause is the typed blocker and may acknowledge this
+ * revision because Resume commits a new one.
  *
  * An older sender may advance only its own revision; it cannot clear a claim or
  * failure state belonging to a newer revision. The control -> workspace ->
@@ -33819,7 +34581,10 @@ export async function claimPendingSessionWorkflowWakes(
  */
 export type SessionWorkflowWakeDeliveryResult =
   | { action: "acknowledged" }
-  | { action: "pending_admission"; blocker: "pending_agent_steer" };
+  | {
+      action: "pending_admission";
+      blocker: "pending_agent_steer" | "pending_quiescence";
+    };
 
 export async function markSessionWorkflowWakeDelivered(
   db: Database,
@@ -33859,6 +34624,35 @@ export async function markSessionWorkflowWakeDelivered(
           if (pendingAgentSteer) {
             return { action: "pending_admission", blocker: "pending_agent_steer" } as const;
           }
+          const [pendingQuiescence] = await tx
+            .select({ id: schema.sessionTurnAttempts.id })
+            .from(schema.sessionTurnAttempts)
+            .innerJoin(
+              schema.sessionAttemptInterruptions,
+              and(
+                eq(
+                  schema.sessionAttemptInterruptions.workspaceId,
+                  schema.sessionTurnAttempts.workspaceId,
+                ),
+                eq(
+                  schema.sessionAttemptInterruptions.sessionId,
+                  schema.sessionTurnAttempts.sessionId,
+                ),
+                eq(schema.sessionAttemptInterruptions.attemptId, schema.sessionTurnAttempts.id),
+              ),
+            )
+            .where(
+              and(
+                eq(schema.sessionTurnAttempts.workspaceId, input.workspaceId),
+                eq(schema.sessionTurnAttempts.sessionId, input.sessionId),
+                isNull(schema.sessionTurnAttempts.quiescedAt),
+                inArray(schema.sessionAttemptInterruptions.state, ["settled", "rejected_stale"]),
+              ),
+            )
+            .limit(1);
+          if (pendingQuiescence) {
+            return { action: "pending_admission", blocker: "pending_quiescence" } as const;
+          }
         }
         const [row] = await tx
           .update(schema.sessionWorkflowWakeOutbox)
@@ -34093,55 +34887,6 @@ export async function addSessionSystemUpdate(
   return await addSessionSystemUpdateWithSourceMutation(db, input, async () => undefined);
 }
 
-async function requeueInterruptedSessionSystemUpdatesForTurnTx(
-  tx: Database,
-  workspaceId: string,
-  sessionId: string,
-  turnId: string,
-): Promise<void> {
-  await tx
-    .update(schema.sessionSystemUpdates)
-    .set({ state: "pending", deliveredTurnId: null, deliveredAt: null })
-    .where(
-      and(
-        eq(schema.sessionSystemUpdates.workspaceId, workspaceId),
-        eq(schema.sessionSystemUpdates.sessionId, sessionId),
-        eq(schema.sessionSystemUpdates.deliveredTurnId, turnId),
-        eq(schema.sessionSystemUpdates.state, "delivered"),
-      ),
-    );
-}
-
-/**
- * A failed internal-only inference must not manufacture another inference by
- * making its inputs immediately runnable again. Preserve ordinary internal
- * updates as deferred input for the next real prompt/new update. Goal
- * continuation notices are derivable from the durable goal and become terminal
- * so the goal evaluator can pause or synthesize the next valid continuation.
- */
-async function deferFailedSessionSystemUpdatesForTurnTx(
-  tx: Database,
-  workspaceId: string,
-  sessionId: string,
-  turnId: string,
-): Promise<void> {
-  await tx
-    .update(schema.sessionSystemUpdates)
-    .set({
-      state: sql`case when ${schema.sessionSystemUpdates.payload} ->> 'type' = 'goal_continuation' then 'failed' else 'deferred' end`,
-      deliveredTurnId: null,
-      deliveredAt: null,
-    })
-    .where(
-      and(
-        eq(schema.sessionSystemUpdates.workspaceId, workspaceId),
-        eq(schema.sessionSystemUpdates.sessionId, sessionId),
-        eq(schema.sessionSystemUpdates.deliveredTurnId, turnId),
-        eq(schema.sessionSystemUpdates.state, "delivered"),
-      ),
-    );
-}
-
 /**
  * Persist one internal update without fabricating a user prompt or queue row.
  * Dedupe and any producer/outbox mutation commit in the same transaction.
@@ -34243,6 +34988,7 @@ export async function addSessionSystemUpdateWithSourceMutation(
         }
 
         const now = new Date();
+        const eventPreview = internalUpdateEventMember(inserted);
         const [event] = await tx
           .insert(schema.sessionEvents)
           .values({
@@ -34252,11 +34998,13 @@ export async function addSessionSystemUpdateWithSourceMutation(
             sequence: session.lastSequence + 1,
             type: "system.update.pending",
             payload: sanitizeEventPayload({
-              updateId: inserted.id,
-              kind: input.kind,
-              classification: input.classification,
-              sourceId: input.sourceId,
-              summary: input.summary,
+              updateId: eventPreview.id,
+              kind: eventPreview.kind,
+              classification: eventPreview.classification,
+              sourceId: eventPreview.sourceId,
+              sourceIdTruncated: eventPreview.sourceIdTruncated,
+              summary: eventPreview.summary,
+              summaryTruncated: eventPreview.summaryTruncated,
             }),
             occurredAt: now,
           })
@@ -34307,7 +35055,7 @@ export async function listOutstandingSessionSystemUpdates(
         and(
           eq(schema.sessionSystemUpdates.workspaceId, workspaceId),
           eq(schema.sessionSystemUpdates.sessionId, sessionId),
-          inArray(schema.sessionSystemUpdates.state, ["pending", "deferred"]),
+          eq(schema.sessionSystemUpdates.state, "pending"),
         ),
       )
       .orderBy(asc(schema.sessionSystemUpdates.createdAt), asc(schema.sessionSystemUpdates.id));
@@ -34363,6 +35111,7 @@ function mapSessionSystemUpdate(
     lineage: row.lineage,
     state: row.state as SessionSystemUpdateState,
     deliveredTurnId: row.deliveredTurnId,
+    deliveredHistoryItemId: row.deliveredHistoryItemId,
     deliveredAt: row.deliveredAt?.toISOString() ?? null,
     createdAt: row.createdAt.toISOString(),
   };
@@ -35210,6 +35959,7 @@ function mapSession(
     titleSource: (row.titleSource as "user" | "agent" | null) ?? null,
     instructions: row.instructions ?? null,
     resources: row.resources as ResourceRef[],
+    skills: (row.skills as SessionSkill[]) ?? [],
     tools: row.tools as ToolRef[],
     toolPolicy: (row.toolPolicy as SessionToolPolicy | null) ?? {
       mode: "legacy",
@@ -35239,6 +35989,7 @@ function mapSession(
     rigId: row.rigId ?? null,
     rigVersionId: row.rigVersionId ?? null,
     firstPartyMcpPermissions: (row.firstPartyMcpPermissions as Permission[] | null) ?? null,
+    firstPartyMcpTools: (row.firstPartyMcpTools as FirstPartyMcpToolName[] | null) ?? null,
     mcpServers,
     parentSessionId: row.parentSessionId ?? null,
     rootSessionId: row.rootSessionId,