@opengeni/db 0.19.0 → 0.22.1

package/src/index.ts

@@ -33,6 +33,7 @@ import type {
   HostUsageExport,
   HostUsageExportBatch,
   ManagedAccount,
+  McpPersonalConnectionDelegation,
   Permission,
   PackInstallation,
   PackInstallationStatus,
@@ -103,6 +104,7 @@ import type {
 } from "@opengeni/contracts";
 import {
   DEFAULT_FIRST_PARTY_MCP_TOOLS,
+  McpPersonalConnectionDelegations,
   SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS,
   backendForNativeSnapshotProvider,
   canonicalModalCheckpointProviderBinding,
@@ -110,6 +112,7 @@ import {
   parseWorkspaceArchiveDescriptor,
   stableJson,
 } from "@opengeni/contracts";
+
 import {
   approvalIdentifier,
   boundWorkspaceControlEvent,
@@ -239,6 +242,7 @@ export * from "./new-session-drafts";
 export * from "./workspace-instruction-policies";
 export * from "./preference-registry";
 export * from "./memory-governance";
+export * from "./scoped-knowledge";
 export { interruptedToolCallResult } from "./session-tool-call-settlement";
 export { decryptEnvironmentValue, encryptEnvironmentValue } from "./environment-crypto";
 export {
@@ -286,6 +290,17 @@ export * from "./memory-domain";
 // `userLookup` is the injection seam for hosts on a different driver.
 // `PostgresJsDatabase<typeof schema>` is assignable to this, so standalone is
 // unaffected.
+function parsedPersonalConnectionDelegations(
+  value: unknown,
+  context: string,
+): McpPersonalConnectionDelegation[] {
+  const parsed = McpPersonalConnectionDelegations.safeParse(value);
+  if (!parsed.success) {
+    throw new Error(`Invalid personal MCP delegation snapshot at ${context}`);
+  }
+  return parsed.data.map((delegation) => ({ ...delegation }));
+}
+
 export type Database = PgDatabase<any, typeof schema>;
 
 /** Raised when a durable session tool-policy write lost its version fence. */
@@ -3296,6 +3311,10 @@ export type CreateScheduledTaskInput = {
   runMode: ScheduledTaskRunMode;
   overlapPolicy: ScheduledTaskOverlapPolicy;
   agentConfig: ScheduledTaskAgentConfig;
+  createdBy?: TurnInitiator;
+  createdByContext?: TurnInitiatorContext;
+  createdByActor?: AgentSessionCreationActor | null;
+  personalConnectionDelegations?: McpPersonalConnectionDelegation[];
   variableSetId?: string | null;
   // The rig each run binds to (M3); active version resolved per fire at dispatch.
   rigId?: string | null;
@@ -3309,6 +3328,7 @@ export type UpdateScheduledTaskInput = Partial<{
   runMode: ScheduledTaskRunMode;
   overlapPolicy: ScheduledTaskOverlapPolicy;
   agentConfig: ScheduledTaskAgentConfig;
+  personalConnectionDelegations: McpPersonalConnectionDelegation[];
   reusableSessionId: string | null;
   variableSetId: string | null;
   rigId: string | null;
@@ -3732,6 +3752,7 @@ export type EnqueueSessionTurnInput = {
   lineage?: Record<string, unknown>;
   initiator: TurnInitiator;
   initiatorContext?: TurnInitiatorContext;
+  personalConnectionDelegations?: McpPersonalConnectionDelegation[];
   /** Steer inserts before all waiting prompts; Send appends after them. */
   placement?: "head" | "tail";
 };
@@ -3742,6 +3763,7 @@ export type EnqueueSessionTurnInput = {
  */
 export type SessionTurnForExecution = SessionTurn & {
   turnInstructions: string | null;
+  personalConnectionDelegations: McpPersonalConnectionDelegation[];
 };
 
 export async function createFileUpload(
@@ -7144,7 +7166,9 @@ export async function loadConnectionCredentialForBroker(
   if (input.connectionId) {
     conditions.push(eq(schema.connections.id, input.connectionId));
   } else {
-    conditions.push(eq(schema.connections.providerDomain, input.providerDomain));
+    conditions.push(
+      sql`lower(${schema.connections.providerDomain}) = lower(${input.providerDomain})`,
+    );
     if (input.kind) {
       conditions.push(eq(schema.connections.kind, input.kind));
     }
@@ -7174,6 +7198,8 @@ export async function loadConnectionCredentialForBroker(
             : [
                 desc(sql`(${schema.connections.status} = 'active')`),
                 desc(schema.connections.updatedAt),
+                desc(schema.connections.createdAt),
+                desc(schema.connections.id),
               ]),
         )
         .limit(1);
@@ -9018,7 +9044,27 @@ export async function createScheduledTask(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const [row] = await scopedDb.insert(schema.scheduledTasks).values(input).returning();
+      const frozenCreator = await frozenSessionCreatorForInsert(scopedDb, input);
+      const [row] = await scopedDb
+        .insert(schema.scheduledTasks)
+        .values({
+          id: input.id,
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          name: input.name,
+          status: input.status,
+          schedule: input.schedule,
+          temporalScheduleId: input.temporalScheduleId,
+          runMode: input.runMode,
+          overlapPolicy: input.overlapPolicy,
+          agentConfig: input.agentConfig,
+          ...creatorColumns(frozenCreator),
+          personalConnectionDelegations: input.personalConnectionDelegations ?? [],
+          variableSetId: input.variableSetId ?? null,
+          rigId: input.rigId ?? null,
+          metadata: input.metadata,
+        })
+        .returning();
       if (!row) {
         throw new Error("Failed to create scheduled task");
       }
@@ -9043,6 +9089,9 @@ export async function updateScheduledTask(
         ...(input.runMode !== undefined ? { runMode: input.runMode } : {}),
         ...(input.overlapPolicy !== undefined ? { overlapPolicy: input.overlapPolicy } : {}),
         ...(input.agentConfig !== undefined ? { agentConfig: input.agentConfig } : {}),
+        ...(input.personalConnectionDelegations !== undefined
+          ? { personalConnectionDelegations: input.personalConnectionDelegations }
+          : {}),
         ...(input.reusableSessionId !== undefined
           ? { reusableSessionId: input.reusableSessionId }
           : {}),
@@ -9085,6 +9134,31 @@ export async function getScheduledTask(
   });
 }
 
+export async function getScheduledTaskPersonalConnectionDelegations(
+  db: Database,
+  workspaceId: string,
+  taskId: string,
+): Promise<McpPersonalConnectionDelegation[]> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select({ delegations: schema.scheduledTasks.personalConnectionDelegations })
+      .from(schema.scheduledTasks)
+      .where(
+        and(
+          eq(schema.scheduledTasks.workspaceId, workspaceId),
+          eq(schema.scheduledTasks.id, taskId),
+        ),
+      )
+      .limit(1);
+    return row
+      ? parsedPersonalConnectionDelegations(
+          row.delegations,
+          `scheduled_tasks:${workspaceId}:${taskId}`,
+        )
+      : [];
+  });
+}
+
 export async function requireScheduledTask(
   db: Database,
   workspaceId: string,
@@ -15672,6 +15746,816 @@ export async function listSessionMcpServersForRun(
   });
 }
 
+export type ConnectorActionPolicyDecision = schema.ConnectorActionPolicyDecision;
+export type ConnectorActionPolicySnapshotEntry = schema.ConnectorActionPolicySnapshotEntry;
+
+export type ConnectorActionAttemptIdentity = {
+  accountId: string;
+  workspaceId: string;
+  sessionId: string;
+  turnId: string;
+  attemptId: string;
+  executionGeneration: number;
+  initiator: Pick<TurnInitiator, "kind" | "subjectId">;
+};
+
+export type ConnectorActionInvocation = {
+  approvalId: string;
+  connectionId?: string | null;
+  serverId: string;
+  toolName: string;
+  arguments: unknown;
+};
+
+export type PrepareConnectorActionApprovalResult =
+  | { managed: false; decision: "unmanaged" }
+  | {
+      managed: true;
+      decision: ConnectorActionPolicyDecision;
+      requestId?: string;
+      actionFingerprint: string;
+    };
+
+export type BeginConnectorActionExecutionResult =
+  | { allowed: true; managed: false }
+  | {
+      allowed: true;
+      managed: true;
+      requestId: string;
+      actionFingerprint: string;
+    }
+  | {
+      allowed: false;
+      managed: true;
+      reason: "approval_required" | "blocked" | "rejected" | "already_executed" | "uncertain_retry";
+      requestId: string;
+      actionFingerprint: string;
+    };
+
+const CONNECTOR_ACTION_POLICY_SNAPSHOT_MAX = 2048;
+const CONNECTOR_ACTION_APPROVAL_ID_MAX = 1024;
+const CONNECTOR_ACTION_CONNECTION_ID_MAX = 512;
+const CONNECTOR_ACTION_SERVER_ID_MAX = 256;
+const CONNECTOR_ACTION_NAME_MAX = 512;
+
+function boundedConnectorActionText(value: string, label: string, max: number): string {
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || Buffer.byteLength(trimmed, "utf8") > max) {
+    throw new Error(`${label} must be between 1 and ${max} UTF-8 bytes`);
+  }
+  return trimmed;
+}
+
+/**
+ * Resolve the request's policy selector. This caller-controlled value is used
+ * only transiently to match the attempt-frozen policy snapshot; it must never
+ * be copied into a request row or audit event.
+ */
+function connectorActionPolicySelector(toolName: string, args: unknown): string {
+  if (args && typeof args === "object" && !Array.isArray(args)) {
+    const action = (args as Record<string, unknown>).action;
+    if (typeof action === "string" && action.trim().length > 0) {
+      return boundedConnectorActionText(action, "connector action name", CONNECTOR_ACTION_NAME_MAX);
+    }
+  }
+  return toolName;
+}
+
+function connectorActionEvidenceName(
+  resolved: Exclude<ResolvedConnectorActionPolicy, { managed: false }>,
+): string {
+  return resolved.entry?.actionName ?? "*";
+}
+
+function connectorActionFingerprint(input: {
+  workspaceId: string;
+  connectionId: string;
+  serverId: string;
+  toolName: string;
+  actionName: string;
+  arguments: unknown;
+}): string {
+  return createHash("sha256")
+    .update(
+      stableJson({
+        workspaceId: input.workspaceId,
+        connectionId: input.connectionId,
+        serverId: input.serverId,
+        toolName: input.toolName,
+        actionName: input.actionName,
+        arguments: input.arguments ?? null,
+      }),
+      "utf8",
+    )
+    .digest("hex");
+}
+
+type ResolvedConnectorActionPolicy =
+  | { managed: false }
+  | {
+      managed: true;
+      source: "explicit";
+      entry: ConnectorActionPolicySnapshotEntry;
+    }
+  | {
+      managed: true;
+      source: "ambiguous";
+      entry: null;
+      decision: "block";
+    };
+
+/** Resolve one immutable attempt snapshot with exact-over-wildcard precedence. */
+export function resolveConnectorActionPolicy(
+  snapshot: readonly ConnectorActionPolicySnapshotEntry[],
+  input: { connectionId: string; serverId: string; toolName: string; actionName: string },
+): ResolvedConnectorActionPolicy {
+  const candidates = snapshot
+    .filter(
+      (entry) =>
+        entry.connectionId === input.connectionId &&
+        (entry.serverId === input.serverId || entry.serverId === "*") &&
+        (entry.toolName === input.toolName || entry.toolName === "*") &&
+        (entry.actionName === input.actionName || entry.actionName === "*"),
+    )
+    .map((entry) => ({
+      entry,
+      specificity:
+        Number(entry.serverId !== "*") +
+        Number(entry.toolName !== "*") +
+        Number(entry.actionName !== "*"),
+    }))
+    .sort(
+      (left, right) =>
+        right.specificity - left.specificity || left.entry.id.localeCompare(right.entry.id),
+    );
+  const selected = candidates[0];
+  if (!selected) return { managed: false };
+  if (candidates[1]?.specificity === selected.specificity) {
+    return { managed: true, source: "ambiguous", entry: null, decision: "block" };
+  }
+  return { managed: true, source: "explicit", entry: selected.entry };
+}
+
+function connectorActionAuditMetadata(
+  row: typeof schema.connectorActionRequests.$inferSelect,
+  extra: Record<string, unknown> = {},
+): Record<string, unknown> {
+  return {
+    requestId: row.id,
+    sessionId: row.sessionId,
+    turnId: row.turnId,
+    attemptId: row.creationAttemptId,
+    creationExecutionGeneration: row.creationExecutionGeneration,
+    executionAttemptId: row.executionAttemptId,
+    executionAttemptGeneration: row.executionAttemptGeneration,
+    approvalId: row.approvalId,
+    initiatorKind: row.initiatorKind,
+    initiatorSubjectId: row.initiatorSubjectId,
+    connectionId: row.connectionId,
+    connectionVersion: row.connectionVersion,
+    serverId: row.serverId,
+    toolName: row.toolName,
+    actionName: row.actionName,
+    policyId: row.policyId,
+    policyVersion: row.policyVersion,
+    policySource: row.policySource,
+    policyDecision: row.policyDecision,
+    actionFingerprint: row.actionFingerprint,
+    ...extra,
+  };
+}
+
+async function insertConnectorActionAudit(
+  db: Database,
+  input: {
+    row: typeof schema.connectorActionRequests.$inferSelect;
+    action: string;
+    subjectId: string;
+    extra?: Record<string, unknown>;
+  },
+): Promise<void> {
+  await db.insert(schema.auditEvents).values({
+    accountId: input.row.accountId,
+    workspaceId: input.row.workspaceId,
+    subjectId: input.subjectId,
+    action: input.action,
+    targetType: "connector_action_request",
+    targetId: input.row.id,
+    metadata: connectorActionAuditMetadata(input.row, input.extra),
+  });
+}
+
+function normalizedConnectorActionInvocation(
+  identity: ConnectorActionAttemptIdentity,
+  invocation: ConnectorActionInvocation,
+): {
+  approvalId: string;
+  connectionId: string | null;
+  serverId: string;
+  toolName: string;
+  policyActionSelector: string;
+  arguments: unknown;
+} {
+  const approvalId = boundedConnectorActionText(
+    invocation.approvalId,
+    "connector approval id",
+    CONNECTOR_ACTION_APPROVAL_ID_MAX,
+  );
+  const serverId = boundedConnectorActionText(
+    invocation.serverId,
+    "connector server id",
+    CONNECTOR_ACTION_SERVER_ID_MAX,
+  );
+  const toolName = boundedConnectorActionText(
+    invocation.toolName,
+    "connector tool name",
+    CONNECTOR_ACTION_NAME_MAX,
+  );
+  const policyActionSelector = connectorActionPolicySelector(toolName, invocation.arguments);
+  const connectionId = invocation.connectionId?.trim()
+    ? boundedConnectorActionText(
+        invocation.connectionId,
+        "connector connection id",
+        CONNECTOR_ACTION_CONNECTION_ID_MAX,
+      )
+    : null;
+  return {
+    approvalId,
+    connectionId,
+    serverId,
+    toolName,
+    policyActionSelector,
+    arguments: invocation.arguments,
+  };
+}
+
+function durableConnectorActionInvocation(
+  identity: ConnectorActionAttemptIdentity,
+  invocation: ReturnType<typeof normalizedConnectorActionInvocation> & { connectionId: string },
+  resolved: Exclude<ResolvedConnectorActionPolicy, { managed: false }>,
+): {
+  approvalId: string;
+  connectionId: string;
+  serverId: string;
+  toolName: string;
+  actionName: string;
+  actionFingerprint: string;
+} {
+  const actionName = connectorActionEvidenceName(resolved);
+  return {
+    approvalId: invocation.approvalId,
+    connectionId: invocation.connectionId,
+    serverId: invocation.serverId,
+    toolName: invocation.toolName,
+    actionName,
+    actionFingerprint: connectorActionFingerprint({
+      workspaceId: identity.workspaceId,
+      connectionId: invocation.connectionId,
+      serverId: invocation.serverId,
+      toolName: invocation.toolName,
+      actionName,
+      arguments: invocation.arguments,
+    }),
+  };
+}
+
+async function connectorActionAttemptSnapshot(
+  db: Database,
+  identity: ConnectorActionAttemptIdentity,
+): Promise<ConnectorActionPolicySnapshotEntry[]> {
+  const [attempt] = await db
+    .select({
+      accountId: schema.sessionTurnAttempts.accountId,
+      sessionId: schema.sessionTurnAttempts.sessionId,
+      turnId: schema.sessionTurnAttempts.turnId,
+      executionGeneration: schema.sessionTurnAttempts.executionGeneration,
+      state: schema.sessionTurnAttempts.state,
+      connectorActionPolicies: schema.sessionTurnAttempts.connectorActionPolicies,
+    })
+    .from(schema.sessionTurnAttempts)
+    .where(
+      and(
+        eq(schema.sessionTurnAttempts.workspaceId, identity.workspaceId),
+        eq(schema.sessionTurnAttempts.id, identity.attemptId),
+      ),
+    )
+    .limit(1);
+  if (
+    !attempt ||
+    attempt.accountId !== identity.accountId ||
+    attempt.sessionId !== identity.sessionId ||
+    attempt.turnId !== identity.turnId ||
+    attempt.executionGeneration !== identity.executionGeneration ||
+    !["claimed", "running"].includes(attempt.state)
+  ) {
+    throw new Error(`connector action attempt ownership is unavailable: ${identity.attemptId}`);
+  }
+  if (attempt.connectorActionPolicies.length > CONNECTOR_ACTION_POLICY_SNAPSHOT_MAX) {
+    throw new Error("connector action policy snapshot exceeds the runtime bound");
+  }
+  return attempt.connectorActionPolicies;
+}
+
+function connectorActionRequestMatches(
+  row: typeof schema.connectorActionRequests.$inferSelect,
+  input: {
+    identity: ConnectorActionAttemptIdentity;
+    invocation: ReturnType<typeof durableConnectorActionInvocation>;
+    resolved: Exclude<ResolvedConnectorActionPolicy, { managed: false }>;
+  },
+): boolean {
+  const entry = input.resolved.entry;
+  return (
+    row.accountId === input.identity.accountId &&
+    row.workspaceId === input.identity.workspaceId &&
+    row.sessionId === input.identity.sessionId &&
+    row.turnId === input.identity.turnId &&
+    row.creationAttemptId === input.identity.attemptId &&
+    row.creationExecutionGeneration === input.identity.executionGeneration &&
+    row.approvalId === input.invocation.approvalId &&
+    row.initiatorKind === input.identity.initiator.kind &&
+    row.initiatorSubjectId === input.identity.initiator.subjectId &&
+    row.connectionId === input.invocation.connectionId &&
+    row.serverId === input.invocation.serverId &&
+    row.toolName === input.invocation.toolName &&
+    row.actionName === input.invocation.actionName &&
+    row.policyId === (entry?.id ?? null) &&
+    row.policyVersion === (entry?.version ?? null) &&
+    row.policySource === input.resolved.source &&
+    row.policyDecision === (entry?.policy ?? "block") &&
+    row.actionFingerprint === input.invocation.actionFingerprint
+  );
+}
+
+function connectorActionRequestMatchesLogicalCall(
+  row: typeof schema.connectorActionRequests.$inferSelect,
+  identity: ConnectorActionAttemptIdentity,
+  invocation: ReturnType<typeof normalizedConnectorActionInvocation>,
+): boolean {
+  if (!invocation.connectionId) return false;
+  return (
+    row.accountId === identity.accountId &&
+    row.workspaceId === identity.workspaceId &&
+    row.sessionId === identity.sessionId &&
+    row.turnId === identity.turnId &&
+    row.approvalId === invocation.approvalId &&
+    row.initiatorKind === identity.initiator.kind &&
+    row.initiatorSubjectId === identity.initiator.subjectId &&
+    row.connectionId === invocation.connectionId &&
+    row.serverId === invocation.serverId &&
+    row.toolName === invocation.toolName &&
+    row.actionFingerprint ===
+      connectorActionFingerprint({
+        workspaceId: identity.workspaceId,
+        connectionId: invocation.connectionId,
+        serverId: invocation.serverId,
+        toolName: invocation.toolName,
+        actionName: row.actionName,
+        arguments: invocation.arguments,
+      })
+  );
+}
+
+async function insertConnectorActionRequest(
+  db: Database,
+  input: {
+    identity: ConnectorActionAttemptIdentity;
+    invocation: ReturnType<typeof durableConnectorActionInvocation>;
+    resolved: Exclude<ResolvedConnectorActionPolicy, { managed: false }>;
+    status: "pending" | "blocked" | "executing";
+  },
+): Promise<{ row: typeof schema.connectorActionRequests.$inferSelect; inserted: boolean }> {
+  const entry = input.resolved.entry;
+  const [inserted] = await db
+    .insert(schema.connectorActionRequests)
+    .values({
+      accountId: input.identity.accountId,
+      workspaceId: input.identity.workspaceId,
+      sessionId: input.identity.sessionId,
+      turnId: input.identity.turnId,
+      creationAttemptId: input.identity.attemptId,
+      creationExecutionGeneration: input.identity.executionGeneration,
+      approvalId: input.invocation.approvalId,
+      initiatorKind: input.identity.initiator.kind,
+      initiatorSubjectId: input.identity.initiator.subjectId,
+      connectionId: input.invocation.connectionId!,
+      serverId: input.invocation.serverId,
+      toolName: input.invocation.toolName,
+      actionName: input.invocation.actionName,
+      policyId: entry?.id ?? null,
+      policyVersion: entry?.version ?? null,
+      policySource: input.resolved.source,
+      policyDecision: entry?.policy ?? "block",
+      actionFingerprint: input.invocation.actionFingerprint!,
+      status: input.status,
+      ...(input.status === "executing"
+        ? {
+            executionAttemptId: input.identity.attemptId,
+            executionAttemptGeneration: input.identity.executionGeneration,
+            executionStartedAt: new Date(),
+          }
+        : {}),
+    })
+    .onConflictDoNothing({
+      target: [
+        schema.connectorActionRequests.workspaceId,
+        schema.connectorActionRequests.sessionId,
+        schema.connectorActionRequests.turnId,
+        schema.connectorActionRequests.approvalId,
+      ],
+    })
+    .returning();
+  if (inserted) return { row: inserted, inserted: true };
+  const [existing] = await db
+    .select()
+    .from(schema.connectorActionRequests)
+    .where(
+      and(
+        eq(schema.connectorActionRequests.workspaceId, input.identity.workspaceId),
+        eq(schema.connectorActionRequests.sessionId, input.identity.sessionId),
+        eq(schema.connectorActionRequests.turnId, input.identity.turnId),
+        eq(schema.connectorActionRequests.approvalId, input.invocation.approvalId),
+      ),
+    )
+    .for("update")
+    .limit(1);
+  if (!existing || !connectorActionRequestMatches(existing, input)) {
+    throw new Error("connector action approval id conflicts with different immutable inputs");
+  }
+  return { row: existing, inserted: false };
+}
+
+export async function upsertConnectorActionPolicy(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    connectionId: string;
+    serverId: string;
+    toolName: string;
+    actionName: string;
+    policy: ConnectorActionPolicyDecision;
+  },
+): Promise<{ policy: typeof schema.connectorActionPolicies.$inferSelect; changed: boolean }> {
+  const scope = {
+    connectionId: boundedConnectorActionText(
+      input.connectionId,
+      "connector connection id",
+      CONNECTOR_ACTION_CONNECTION_ID_MAX,
+    ),
+    serverId: boundedConnectorActionText(
+      input.serverId,
+      "connector server id",
+      CONNECTOR_ACTION_SERVER_ID_MAX,
+    ),
+    toolName: boundedConnectorActionText(
+      input.toolName,
+      "connector tool name",
+      CONNECTOR_ACTION_NAME_MAX,
+    ),
+    actionName: boundedConnectorActionText(
+      input.actionName,
+      "connector action name",
+      CONNECTOR_ACTION_NAME_MAX,
+    ),
+  };
+  const subjectId = boundedConnectorActionText(input.subjectId, "policy actor", 1024);
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        await assertWorkspaceAccountPairInScope(tx, input.accountId, input.workspaceId);
+        const [existing] = await tx
+          .select()
+          .from(schema.connectorActionPolicies)
+          .where(
+            and(
+              eq(schema.connectorActionPolicies.workspaceId, input.workspaceId),
+              eq(schema.connectorActionPolicies.connectionId, scope.connectionId),
+              eq(schema.connectorActionPolicies.serverId, scope.serverId),
+              eq(schema.connectorActionPolicies.toolName, scope.toolName),
+              eq(schema.connectorActionPolicies.actionName, scope.actionName),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (existing?.policy === input.policy) return { policy: existing, changed: false };
+        const now = new Date();
+        const [row] = existing
+          ? await tx
+              .update(schema.connectorActionPolicies)
+              .set({
+                policy: input.policy,
+                version: existing.version + 1,
+                updatedBySubjectId: subjectId,
+                updatedAt: now,
+              })
+              .where(eq(schema.connectorActionPolicies.id, existing.id))
+              .returning()
+          : await tx
+              .insert(schema.connectorActionPolicies)
+              .values({
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                ...scope,
+                policy: input.policy,
+                createdBySubjectId: subjectId,
+                updatedBySubjectId: subjectId,
+              })
+              .returning();
+        if (!row) throw new Error("Failed to persist connector action policy");
+        await tx.insert(schema.auditEvents).values({
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          subjectId,
+          action: "connector.action.policy_changed",
+          targetType: "connector_action_policy",
+          targetId: row.id,
+          metadata: {
+            connectionId: row.connectionId,
+            serverId: row.serverId,
+            toolName: row.toolName,
+            actionName: row.actionName,
+            policy: row.policy,
+            version: row.version,
+            previousPolicy: existing?.policy ?? null,
+            previousVersion: existing?.version ?? null,
+          },
+        });
+        return { policy: row, changed: true };
+      }),
+  );
+}
+
+export async function prepareConnectorActionApproval(
+  db: Database,
+  identity: ConnectorActionAttemptIdentity,
+  invocation: ConnectorActionInvocation,
+): Promise<PrepareConnectorActionApprovalResult> {
+  const normalized = normalizedConnectorActionInvocation(identity, invocation);
+  if (!normalized.connectionId) {
+    return { managed: false, decision: "unmanaged" };
+  }
+  return await withRlsContext(
+    db,
+    { accountId: identity.accountId, workspaceId: identity.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const snapshot = await connectorActionAttemptSnapshot(tx as unknown as Database, identity);
+        const resolved = resolveConnectorActionPolicy(snapshot, {
+          connectionId: normalized.connectionId!,
+          serverId: normalized.serverId,
+          toolName: normalized.toolName,
+          actionName: normalized.policyActionSelector,
+        });
+        if (!resolved.managed) return { managed: false, decision: "unmanaged" } as const;
+        const durable = durableConnectorActionInvocation(
+          identity,
+          { ...normalized, connectionId: normalized.connectionId! },
+          resolved,
+        );
+        const decision = resolved.entry?.policy ?? "block";
+        if (decision === "allow") {
+          return {
+            managed: true,
+            decision,
+            actionFingerprint: durable.actionFingerprint,
+          } as const;
+        }
+        const { row, inserted } = await insertConnectorActionRequest(tx as unknown as Database, {
+          identity,
+          invocation: durable,
+          resolved,
+          status: decision === "ask" ? "pending" : "blocked",
+        });
+        if (inserted) {
+          await insertConnectorActionAudit(tx as unknown as Database, {
+            row,
+            action:
+              decision === "ask"
+                ? "connector.action.approval_requested"
+                : "connector.action.blocked",
+            subjectId: identity.initiator.subjectId,
+            extra: { outcome: decision },
+          });
+        }
+        return {
+          managed: true,
+          decision,
+          requestId: row.id,
+          actionFingerprint: row.actionFingerprint,
+        } as const;
+      }),
+  );
+}
+
+export async function beginConnectorActionExecution(
+  db: Database,
+  identity: ConnectorActionAttemptIdentity,
+  invocation: ConnectorActionInvocation,
+): Promise<BeginConnectorActionExecutionResult> {
+  const normalized = normalizedConnectorActionInvocation(identity, invocation);
+  if (!normalized.connectionId) {
+    return { allowed: true, managed: false };
+  }
+  return await withRlsContext(
+    db,
+    { accountId: identity.accountId, workspaceId: identity.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const snapshot = await connectorActionAttemptSnapshot(tx as unknown as Database, identity);
+        const [existing] = await tx
+          .select()
+          .from(schema.connectorActionRequests)
+          .where(
+            and(
+              eq(schema.connectorActionRequests.workspaceId, identity.workspaceId),
+              eq(schema.connectorActionRequests.sessionId, identity.sessionId),
+              eq(schema.connectorActionRequests.turnId, identity.turnId),
+              eq(schema.connectorActionRequests.approvalId, normalized.approvalId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (existing && !connectorActionRequestMatchesLogicalCall(existing, identity, normalized)) {
+          throw new Error("connector action approval id conflicts with different immutable inputs");
+        }
+        let row = existing;
+        let inserted = false;
+        if (!row) {
+          const resolved = resolveConnectorActionPolicy(snapshot, {
+            connectionId: normalized.connectionId!,
+            serverId: normalized.serverId,
+            toolName: normalized.toolName,
+            actionName: normalized.policyActionSelector,
+          });
+          if (!resolved.managed) return { allowed: true, managed: false } as const;
+          const durable = durableConnectorActionInvocation(
+            identity,
+            { ...normalized, connectionId: normalized.connectionId! },
+            resolved,
+          );
+          const decision = resolved.entry?.policy ?? "block";
+          const created = await insertConnectorActionRequest(tx as unknown as Database, {
+            identity,
+            invocation: durable,
+            resolved,
+            status: decision === "ask" ? "pending" : decision === "block" ? "blocked" : "executing",
+          });
+          row = created.row;
+          inserted = created.inserted;
+          if (inserted) {
+            await insertConnectorActionAudit(tx as unknown as Database, {
+              row,
+              action:
+                decision === "ask"
+                  ? "connector.action.approval_requested"
+                  : decision === "block"
+                    ? "connector.action.blocked"
+                    : "connector.action.execution_started",
+              subjectId: identity.initiator.subjectId,
+              extra: { outcome: decision === "allow" ? "started" : decision },
+            });
+          }
+        }
+        if (row.status === "approved") {
+          const [executing] = await tx
+            .update(schema.connectorActionRequests)
+            .set({
+              status: "executing",
+              executionAttemptId: identity.attemptId,
+              executionAttemptGeneration: identity.executionGeneration,
+              executionStartedAt: new Date(),
+              updatedAt: new Date(),
+            })
+            .where(eq(schema.connectorActionRequests.id, row.id))
+            .returning();
+          if (!executing) throw new Error("Approved connector action request disappeared");
+          row = executing;
+          await insertConnectorActionAudit(tx as unknown as Database, {
+            row,
+            action: "connector.action.execution_started",
+            subjectId: identity.initiator.subjectId,
+            extra: { outcome: "started" },
+          });
+          return {
+            allowed: true,
+            managed: true,
+            requestId: row.id,
+            actionFingerprint: row.actionFingerprint,
+          } as const;
+        }
+        if (row.status === "executing") {
+          if (inserted) {
+            return {
+              allowed: true,
+              managed: true,
+              requestId: row.id,
+              actionFingerprint: row.actionFingerprint,
+            } as const;
+          }
+          const [uncertain] = await tx
+            .update(schema.connectorActionRequests)
+            .set({
+              status: "uncertain",
+              outcome: "retry_after_execution_started",
+              executionFinishedAt: new Date(),
+              updatedAt: new Date(),
+            })
+            .where(eq(schema.connectorActionRequests.id, row.id))
+            .returning();
+          if (!uncertain) throw new Error("Executing connector action request disappeared");
+          await insertConnectorActionAudit(tx as unknown as Database, {
+            row: uncertain,
+            action: "connector.action.execution_uncertain",
+            subjectId: identity.initiator.subjectId,
+            extra: { outcome: "retry_denied" },
+          });
+          return {
+            allowed: false,
+            managed: true,
+            reason: "uncertain_retry",
+            requestId: uncertain.id,
+            actionFingerprint: uncertain.actionFingerprint,
+          } as const;
+        }
+        const reason =
+          row.status === "pending"
+            ? "approval_required"
+            : row.status === "rejected"
+              ? "rejected"
+              : row.status === "blocked"
+                ? "blocked"
+                : "already_executed";
+        return {
+          allowed: false,
+          managed: true,
+          reason,
+          requestId: row.id,
+          actionFingerprint: row.actionFingerprint,
+        } as const;
+      }),
+  );
+}
+
+export async function completeConnectorActionExecution(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    requestId: string;
+    attemptId: string;
+    outcome: "completed" | "uncertain";
+  },
+): Promise<void> {
+  await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const [existing] = await tx
+          .select()
+          .from(schema.connectorActionRequests)
+          .where(
+            and(
+              eq(schema.connectorActionRequests.workspaceId, input.workspaceId),
+              eq(schema.connectorActionRequests.id, input.requestId),
+              eq(schema.connectorActionRequests.executionAttemptId, input.attemptId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (!existing) throw new Error("Connector action request not found for completion");
+        if (existing.status === input.outcome) return;
+        if (existing.status !== "executing") {
+          throw new Error(`Connector action request cannot complete from ${existing.status}`);
+        }
+        const [row] = await tx
+          .update(schema.connectorActionRequests)
+          .set({
+            status: input.outcome,
+            outcome: input.outcome,
+            executionFinishedAt: new Date(),
+            updatedAt: new Date(),
+          })
+          .where(eq(schema.connectorActionRequests.id, existing.id))
+          .returning();
+        if (!row) throw new Error("Connector action request disappeared during completion");
+        await insertConnectorActionAudit(tx as unknown as Database, {
+          row,
+          action:
+            input.outcome === "completed"
+              ? "connector.action.execution_completed"
+              : "connector.action.execution_uncertain",
+          subjectId: row.initiatorSubjectId,
+          extra: { outcome: input.outcome },
+        });
+      }),
+  );
+}
+
 type DeploymentDepthPolicy = NestedAgentDepthDeploymentPolicy;
 
 /** Read the persisted deployment fallback; process configuration is not policy authority. */
@@ -15759,6 +16643,7 @@ export type SessionCreateInput = {
   sandboxGroupId?: string | null;
   sandboxOs?: SandboxOs;
   mcpServers?: CreateSessionMcpServerInput[];
+  personalConnectionDelegations?: McpPersonalConnectionDelegation[];
   maxNestedAgentDepthOverride?: number | null;
   allowNestedAgentDepthIncrease?: boolean;
   subjectId?: string | null;
@@ -16131,6 +17016,11 @@ async function createSessionInTransaction(
 
   // Do not run mutable creator validation before keyed denial replay above.
   const frozenCreator = await frozenSessionCreatorForInsert(tx, input);
+  const parentTurnId = input.parentSessionId
+    ? input.createdByActor?.sessionId === input.parentSessionId
+      ? input.createdByActor.turnId
+      : null
+    : null;
   const [inserted] = await tx
     .insert(schema.sessions)
     .values({
@@ -16157,8 +17047,10 @@ async function createSessionInTransaction(
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
       firstPartyMcpTools: input.firstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS],
+      initialPersonalConnectionDelegations: input.personalConnectionDelegations ?? [],
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
+      parentTurnId,
       createIdempotencyKey,
       rootSessionId: decision.rootSessionId,
       nestedAgentDepth: decision.nestedAgentDepth,
@@ -16329,6 +17221,76 @@ export async function getSession(
   });
 }
 
+async function personalConnectionDelegationsForTurnInTransaction(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+  turnId: string,
+): Promise<McpPersonalConnectionDelegation[]> {
+  const [row] = await db
+    .select({ delegations: schema.sessionTurns.personalConnectionDelegations })
+    .from(schema.sessionTurns)
+    .where(
+      and(
+        eq(schema.sessionTurns.workspaceId, workspaceId),
+        eq(schema.sessionTurns.sessionId, sessionId),
+        eq(schema.sessionTurns.id, turnId),
+      ),
+    )
+    .limit(1);
+  return row
+    ? parsedPersonalConnectionDelegations(
+        row.delegations,
+        `session_turns:${workspaceId}:${sessionId}:${turnId}`,
+      )
+    : [];
+}
+
+export async function getSessionTurnPersonalConnectionDelegations(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+  turnId: string,
+): Promise<McpPersonalConnectionDelegation[]> {
+  return await withWorkspaceRls(
+    db,
+    workspaceId,
+    async (scopedDb) =>
+      await personalConnectionDelegationsForTurnInTransaction(
+        scopedDb,
+        workspaceId,
+        sessionId,
+        turnId,
+      ),
+  );
+}
+
+export async function getSessionParentPersonalConnectionDelegations(
+  db: Database,
+  workspaceId: string,
+  childSessionId: string,
+): Promise<McpPersonalConnectionDelegation[]> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [child] = await scopedDb
+      .select({
+        parentSessionId: schema.sessions.parentSessionId,
+        parentTurnId: schema.sessions.parentTurnId,
+      })
+      .from(schema.sessions)
+      .where(
+        and(eq(schema.sessions.workspaceId, workspaceId), eq(schema.sessions.id, childSessionId)),
+      )
+      .limit(1);
+    if (!child?.parentSessionId || !child.parentTurnId) return [];
+    return await personalConnectionDelegationsForTurnInTransaction(
+      scopedDb,
+      workspaceId,
+      child.parentSessionId,
+      child.parentTurnId,
+    );
+  });
+}
+
 export async function getSessionSpawnDenial(
   db: Database,
   workspaceId: string,
@@ -17692,6 +18654,56 @@ export async function listSessions(
   });
 }
 
+/**
+ * Return the model most recently chosen by one human subject in their own
+ * workspace sessions. A later subject-initiated turn supersedes the session's
+ * creation-time default; sessions with no such turn fall back to sessions.model.
+ * Turn timestamp ties use queue position then UUID, and session ties use the
+ * immutable session timestamp/UUID. Other subjects' turns never influence the
+ * result. The workspace filter remains authoritative under FORCE RLS.
+ */
+export async function getLatestSessionModelForSubject(
+  db: Database,
+  workspaceId: string,
+  subjectId: string,
+): Promise<string | null> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const rows = await scopedDb.execute<{ model: string }>(sql`
+      select coalesce(latest_subject_turn.model, subject_session.model) as model
+      from ${schema.sessions} subject_session
+      left join lateral (
+        select
+          subject_turn.id,
+          subject_turn.model,
+          subject_turn.position,
+          subject_turn.created_at
+        from ${schema.sessionTurns} subject_turn
+        where subject_turn.workspace_id = ${workspaceId}
+          and subject_turn.session_id = subject_session.id
+          and subject_turn.initiator_kind = 'subject'
+          and subject_turn.initiator_subject_id = ${subjectId}
+        order by
+          subject_turn.created_at desc,
+          subject_turn.position desc,
+          subject_turn.id desc
+        limit 1
+      ) latest_subject_turn on true
+      where subject_session.workspace_id = ${workspaceId}
+        and subject_session.created_by_kind = 'subject'
+        and subject_session.created_by_subject_id = ${subjectId}
+      order by
+        coalesce(latest_subject_turn.created_at, subject_session.created_at) desc,
+        (latest_subject_turn.id is not null) desc,
+        subject_session.created_at desc,
+        subject_session.id desc,
+        latest_subject_turn.position desc nulls last,
+        latest_subject_turn.id desc nulls last
+      limit 1
+    `);
+    return rows[0]?.model ?? null;
+  });
+}
+
 export type SessionDiscoveryOrderBy = "createdAt" | "updatedAt";
 export type SessionDiscoveryCursor = {
   orderBy: SessionDiscoveryOrderBy;
@@ -34812,6 +35824,32 @@ export async function materializeGoalContinuation(
           return { action: "paused", events: [mapEvent(event)] } as const;
         }
 
+        const [causalTurn] = await tx
+          .select({
+            id: schema.sessionTurns.id,
+            personalConnectionDelegations: schema.sessionTurns.personalConnectionDelegations,
+          })
+          .from(schema.sessionTurns)
+          .where(
+            and(
+              eq(schema.sessionTurns.workspaceId, input.workspaceId),
+              eq(schema.sessionTurns.sessionId, input.sessionId),
+              sql`${schema.sessionTurns.finishedAt} is not null`,
+            ),
+          )
+          .orderBy(
+            desc(schema.sessionTurns.position),
+            desc(schema.sessionTurns.createdAt),
+            desc(schema.sessionTurns.id),
+          )
+          .limit(1);
+        const personalConnectionDelegations = causalTurn
+          ? parsedPersonalConnectionDelegations(
+              causalTurn.personalConnectionDelegations,
+              `session_turns:${input.workspaceId}:${input.sessionId}:${causalTurn.id}`,
+            )
+          : [];
+
         const prompt = input.prompt(decision.goal, decision.autoContinuation, decision.cap);
         const payload = {
           type: "goal_continuation" as const,
@@ -34841,7 +35879,12 @@ export async function materializeGoalContinuation(
             dedupeKey: `goal-continuation:${decision.goal.id}:wake:${goalWakeRevision}`,
             summary: prompt,
             payload,
-            lineage: { goalId: decision.goal.id, goalWakeRevision },
+            lineage: {
+              goalId: decision.goal.id,
+              goalWakeRevision,
+              ...(causalTurn ? { causalTurnId: causalTurn.id } : {}),
+            },
+            personalConnectionDelegations,
             state: "pending",
           })
           .returning();
@@ -35195,6 +36238,10 @@ export async function initializeSessionStartAtomically(
                 : {},
               lineage: {},
               ...initiatorColumns(creator),
+              personalConnectionDelegations: parsedPersonalConnectionDelegations(
+                session.initialPersonalConnectionDelegations,
+                `sessions:${session.workspaceId}:${session.id}:initial`,
+              ),
             })
             .returning();
           if (!turn) throw new Error("Failed to create initial session turn");
@@ -35355,6 +36402,7 @@ export async function enqueueSessionTurn(
               initiator: input.initiator,
               context: input.initiatorContext ?? {},
             }),
+            personalConnectionDelegations: input.personalConnectionDelegations ?? [],
           })
           .returning();
         if (!row) {
@@ -35392,7 +36440,14 @@ const MAX_INTERNAL_UPDATE_EVENT_SOURCE_BYTES = 256;
 
 type BoundedSystemUpdate = Pick<
   typeof schema.sessionSystemUpdates.$inferSelect,
-  "id" | "kind" | "classification" | "sourceId" | "summary" | "payload" | "lineage"
+  | "id"
+  | "kind"
+  | "classification"
+  | "sourceId"
+  | "summary"
+  | "payload"
+  | "lineage"
+  | "personalConnectionDelegations"
 >;
 
 function boundedInternalUpdateEventText(
@@ -35431,10 +36486,14 @@ function internalUpdateEventMember(update: BoundedSystemUpdate) {
   };
 }
 
-function selectBoundedSystemUpdateBatch<T extends BoundedSystemUpdate>(updates: readonly T[]): T[] {
+function selectBoundedSystemUpdateBatch<T extends BoundedSystemUpdate>(
+  updates: readonly T[],
+  canCoalesce: (first: T, candidate: T) => boolean = () => true,
+): T[] {
   const selected: T[] = [];
   let selectedBytes = 0;
   for (const update of updates) {
+    if (selected[0] && !canCoalesce(selected[0], update)) break;
     const updateBytes = Buffer.byteLength(
       JSON.stringify({
         id: update.id,
@@ -35594,7 +36653,17 @@ export async function claimSessionWorkForAttempt(
             }
             validUpdates.push(update);
           }
-          const deliverable = selectBoundedSystemUpdateBatch(validUpdates);
+          const delegationKey = (update: (typeof validUpdates)[number]): string =>
+            stableJson(
+              parsedPersonalConnectionDelegations(
+                update.personalConnectionDelegations,
+                `session_system_updates:${workspaceId}:${sessionId}:${update.id}`,
+              ),
+            );
+          const deliverable = selectBoundedSystemUpdateBatch(
+            validUpdates,
+            (first, candidate) => delegationKey(first) === delegationKey(candidate),
+          );
           if (deliverable.length === 0) {
             const cancellationEvent =
               cancelledUpdateIds.length > 0
@@ -35827,6 +36896,29 @@ export async function claimSessionWorkForAttempt(
           const mcpApprovalPolicies: Record<string, SessionMcpApprovalPolicy> = Object.fromEntries(
             policyRows.map((row) => [row.serverId, row.requireApproval ?? false]),
           );
+          const connectorPolicyRows = await tx
+            .select({
+              id: schema.connectorActionPolicies.id,
+              connectionId: schema.connectorActionPolicies.connectionId,
+              serverId: schema.connectorActionPolicies.serverId,
+              toolName: schema.connectorActionPolicies.toolName,
+              actionName: schema.connectorActionPolicies.actionName,
+              policy: schema.connectorActionPolicies.policy,
+              version: schema.connectorActionPolicies.version,
+            })
+            .from(schema.connectorActionPolicies)
+            .where(eq(schema.connectorActionPolicies.workspaceId, workspaceId))
+            .orderBy(
+              asc(schema.connectorActionPolicies.connectionId),
+              asc(schema.connectorActionPolicies.serverId),
+              asc(schema.connectorActionPolicies.toolName),
+              asc(schema.connectorActionPolicies.actionName),
+              asc(schema.connectorActionPolicies.id),
+            )
+            .limit(2049);
+          if (connectorPolicyRows.length > 2048) {
+            throw new Error("Connector action policy snapshot exceeds the 2048-row bound");
+          }
           return await registerSessionTurnAttemptClaim(tx as unknown as Database, {
             id: input.attemptId,
             accountId: session.accountId,
@@ -35839,6 +36931,7 @@ export async function claimSessionWorkForAttempt(
             temporalActivityId: input.dispatchId,
             verifiedControlRevision: Number(workspaceControl.revision),
             mcpApprovalPolicies,
+            connectorActionPolicies: connectorPolicyRows,
           });
         };
         if (session.activeTurnId !== null) {
@@ -36236,6 +37329,7 @@ export async function claimSessionWorkForAttempt(
                   },
                 ),
                 ...initiatorColumns(compactionInitiator),
+                personalConnectionDelegations: [],
                 startedAt: now,
               })
               .returning();
@@ -36383,6 +37477,12 @@ export async function claimSessionWorkForAttempt(
             },
           });
           let internalInitiator: FrozenTurnInitiator;
+          const authorityUpdate = delivered.updates[0];
+          if (!authorityUpdate) throw new Error("Delivered update batch has no authority source");
+          const internalPersonalConnectionDelegations = parsedPersonalConnectionDelegations(
+            authorityUpdate.personalConnectionDelegations,
+            `session_system_updates:${workspaceId}:${sessionId}:${authorityUpdate.id}`,
+          );
           // Agent Steer is the causal command for this inference. Ordinary
           // machine notices may coalesce into the same batch as context, but
           // their timing must not erase the steering subject's authority.
@@ -36544,6 +37644,7 @@ export async function claimSessionWorkForAttempt(
                 { id: input.dispatchId, generation: 1, triggerEventId },
               ),
               ...initiatorColumns(internalInitiator),
+              personalConnectionDelegations: internalPersonalConnectionDelegations,
               startedAt: now,
             })
             .returning();
@@ -37877,6 +38978,14 @@ export async function settleSessionIdleWithParentOutbox(
         } as const;
       }
       const dedupeKey = `child-completion:${session.id}:${episodeKey}`;
+      const personalConnectionDelegations = session.parentTurnId
+        ? await personalConnectionDelegationsForTurnInTransaction(
+            tx as unknown as Database,
+            workspaceId,
+            session.parentSessionId,
+            session.parentTurnId,
+          )
+        : [];
       await tx
         .insert(schema.sessionSystemUpdateOutbox)
         .values({
@@ -37897,7 +39006,9 @@ export async function settleSessionIdleWithParentOutbox(
           lineage: {
             childSessionId: session.id,
             parentSessionId: session.parentSessionId,
+            ...(session.parentTurnId ? { parentTurnId: session.parentTurnId } : {}),
           },
+          personalConnectionDelegations,
         })
         .onConflictDoNothing({
           target: [
@@ -39982,6 +41093,16 @@ export async function getSessionQueueSnapshot(
       .where(and(eq(schema.sessions.workspaceId, workspaceId), eq(schema.sessions.id, sessionId)))
       .limit(1);
     if (!session) return null;
+    const activePersonalConnections = session.activeTurnId
+      ? (
+          await personalConnectionDelegationsForTurnInTransaction(
+            scopedDb,
+            workspaceId,
+            sessionId,
+            session.activeTurnId,
+          )
+        ).map(({ serverId, providerDomain }) => ({ serverId, providerDomain }))
+      : [];
     const rows = await scopedDb
       .select()
       .from(schema.sessionTurns)
@@ -40025,6 +41146,7 @@ export async function getSessionQueueSnapshot(
     return {
       version: session.queueVersion,
       effectiveControl: serializeEffectiveSessionControl(effectiveControl),
+      activePersonalConnections,
       stoppingPreviousAttempt:
         latestInterruption !== null &&
         latestInterruption.interruptionState !== "rejected_stale" &&
@@ -40073,11 +41195,19 @@ function queuedSteerReplacementAttemptId(metadata: Record<string, unknown>): str
 async function enqueueFailedChildOutboxForTurnTx(
   tx: Database,
   workspaceId: string,
-  session: Pick<typeof schema.sessions.$inferSelect, "id" | "parentSessionId">,
+  session: Pick<typeof schema.sessions.$inferSelect, "id" | "parentSessionId" | "parentTurnId">,
   turn: Pick<typeof schema.sessionTurns.$inferSelect, "id" | "accountId" | "sessionId">,
 ): Promise<void> {
   if (!session.parentSessionId) return;
   const dedupeKey = `child-completion:${turn.sessionId}:turn:${turn.id}`;
+  const personalConnectionDelegations = session.parentTurnId
+    ? await personalConnectionDelegationsForTurnInTransaction(
+        tx,
+        workspaceId,
+        session.parentSessionId,
+        session.parentTurnId,
+      )
+    : [];
   await tx
     .insert(schema.sessionSystemUpdateOutbox)
     .values({
@@ -40099,8 +41229,10 @@ async function enqueueFailedChildOutboxForTurnTx(
       lineage: {
         childSessionId: turn.sessionId,
         parentSessionId: session.parentSessionId,
+        ...(session.parentTurnId ? { parentTurnId: session.parentTurnId } : {}),
         turnId: turn.id,
       },
+      personalConnectionDelegations,
     })
     .onConflictDoNothing({
       target: [
@@ -40137,6 +41269,7 @@ export type SessionSystemUpdateOutboxDelivery = {
   summary: string;
   payload: ChildTerminalResultPayload;
   lineage: Record<string, unknown>;
+  personalConnectionDelegations: McpPersonalConnectionDelegation[];
 };
 
 function mapSystemUpdateOutboxRow(row: {
@@ -40152,6 +41285,7 @@ function mapSystemUpdateOutboxRow(row: {
   summary: string;
   payload: Record<string, unknown>;
   lineage: Record<string, unknown>;
+  personal_connection_delegations: unknown;
 }): SessionSystemUpdateOutboxDelivery {
   if (row.kind !== "child_terminal_result") {
     throw new Error(`System-update outbox contains retired kind ${row.kind}`);
@@ -40170,6 +41304,10 @@ function mapSystemUpdateOutboxRow(row: {
     summary: row.summary,
     payload: parseChildTerminalResultPayload(row.payload),
     lineage: row.lineage,
+    personalConnectionDelegations: parsedPersonalConnectionDelegations(
+      row.personal_connection_delegations,
+      `session_system_update_outbox:${row.workspace_id}:${row.id}`,
+    ),
   };
 }
 
@@ -40214,6 +41352,10 @@ export async function getSessionSystemUpdateOutboxByDedupeKey(
         summary: row.summary,
         payload: parseChildTerminalResultPayload(row.payload),
         lineage: row.lineage,
+        personalConnectionDelegations: parsedPersonalConnectionDelegations(
+          row.personalConnectionDelegations,
+          `session_system_update_outbox:${row.workspaceId}:${row.id}`,
+        ),
       };
     },
   );
@@ -40236,6 +41378,7 @@ export async function claimPendingSessionSystemUpdateOutbox(
     summary: string;
     payload: Record<string, unknown>;
     lineage: Record<string, unknown>;
+    personal_connection_delegations: unknown;
   }>(db, sql`select * from opengeni_private.claim_session_system_update_outbox(${limit})`);
   return rows.map(mapSystemUpdateOutboxRow);
 }
@@ -40586,6 +41729,7 @@ export async function getOrCreateSessionSystemUpdateOutbox(
         summary: input.summary,
         payload: input.payload,
         lineage: input.lineage,
+        personalConnectionDelegations: input.personalConnectionDelegations,
       })
       .onConflictDoUpdate({
         target: [
@@ -40618,6 +41762,10 @@ export async function getOrCreateSessionSystemUpdateOutbox(
       summary: row.summary,
       payload: parseChildTerminalResultPayload(row.payload),
       lineage: row.lineage,
+      personalConnectionDelegations: parsedPersonalConnectionDelegations(
+        row.personalConnectionDelegations,
+        `session_system_update_outbox:${row.workspaceId}:${row.id}`,
+      ),
     };
   });
 }
@@ -40699,6 +41847,7 @@ export type AddSessionSystemUpdateInput = {
   dedupeKey: string;
   summary: string;
   lineage?: Record<string, unknown>;
+  personalConnectionDelegations?: McpPersonalConnectionDelegation[];
 } & SessionSystemUpdateInputVariant;
 
 export type AddSessionSystemUpdateResult =
@@ -40775,6 +41924,7 @@ export async function addSessionSystemUpdateWithSourceMutation(
             summary: input.summary,
             payload: input.payload,
             lineage: input.lineage ?? {},
+            personalConnectionDelegations: input.personalConnectionDelegations ?? [],
             state: "pending",
           })
           .onConflictDoNothing({
@@ -41067,6 +42217,7 @@ export async function acceptSessionApprovalDecision(
     accountId: string;
     workspaceId: string;
     sessionId: string;
+    subjectId: string;
     payload: Record<string, unknown>;
     clientEventId?: string | null;
   },
@@ -41205,6 +42356,41 @@ export async function acceptSessionApprovalDecision(
           })
           .returning();
         if (!event) throw new Error("Failed to append approval decision");
+        const approvalDecision = input.payload.decision;
+        if (approvalDecision === "approve" || approvalDecision === "reject") {
+          const [connectorRequest] = await tx
+            .update(schema.connectorActionRequests)
+            .set({
+              status: approvalDecision === "approve" ? "approved" : "rejected",
+              decision: approvalDecision,
+              decisionBySubjectId: boundedConnectorActionText(
+                input.subjectId,
+                "approval actor",
+                1024,
+              ),
+              decisionEventId: event.id,
+              decidedAt: event.occurredAt,
+              updatedAt: new Date(),
+            })
+            .where(
+              and(
+                eq(schema.connectorActionRequests.workspaceId, input.workspaceId),
+                eq(schema.connectorActionRequests.sessionId, input.sessionId),
+                eq(schema.connectorActionRequests.turnId, turn.id),
+                eq(schema.connectorActionRequests.approvalId, approvalId),
+                eq(schema.connectorActionRequests.status, "pending"),
+              ),
+            )
+            .returning();
+          if (connectorRequest) {
+            await insertConnectorActionAudit(tx as unknown as Database, {
+              row: connectorRequest,
+              action: "connector.action.approval_decided",
+              subjectId: input.subjectId,
+              extra: { decision: approvalDecision },
+            });
+          }
+        }
         await tx
           .update(schema.sessions)
           .set({
@@ -41933,6 +43119,10 @@ function mapSessionTurn(row: typeof schema.sessionTurns.$inferSelect): SessionTu
       row.initiatorContext ?? {},
     ),
     initiatorContext: row.initiatorContext ?? {},
+    personalConnections: parsedPersonalConnectionDelegations(
+      row.personalConnectionDelegations,
+      `session_turns:${row.workspaceId}:${row.sessionId}:${row.id}`,
+    ).map(({ serverId, providerDomain }) => ({ serverId, providerDomain })),
     cancelledBy: row.cancelledBy,
     cancelReason: row.cancelReason,
     startedAt: row.startedAt ? row.startedAt.toISOString() : null,
@@ -41948,6 +43138,10 @@ function mapSessionTurnForExecution(
   return {
     ...mapSessionTurn(row),
     turnInstructions: row.turnInstructions ?? null,
+    personalConnectionDelegations: parsedPersonalConnectionDelegations(
+      row.personalConnectionDelegations,
+      `session_turns:${row.workspaceId}:${row.sessionId}:${row.id}`,
+    ),
   };
 }
 
@@ -42011,6 +43205,16 @@ function mapScheduledTask(row: typeof schema.scheduledTasks.$inferSelect): Sched
     runMode: row.runMode as ScheduledTaskRunMode,
     overlapPolicy: row.overlapPolicy as ScheduledTaskOverlapPolicy,
     agentConfig: row.agentConfig as ScheduledTaskAgentConfig,
+    createdBy: initiatorFromStorage(
+      row.createdByKind,
+      row.createdBySubjectId,
+      row.createdByContext as TurnInitiatorContext,
+    ),
+    createdByContext: row.createdByContext as TurnInitiatorContext,
+    personalConnections: parsedPersonalConnectionDelegations(
+      row.personalConnectionDelegations,
+      `scheduled_tasks:${row.workspaceId}:${row.id}`,
+    ).map(({ serverId, providerDomain }) => ({ serverId, providerDomain })),
     reusableSessionId: row.reusableSessionId,
     variableSetId: row.variableSetId,
     environmentId: row.variableSetId,