@opengeni/db 0.36.1 → 3.1.0-canary.0

package/src/memory-domain.ts

@@ -428,13 +428,7 @@ export const WORKSPACE_MEMORY_BLOCK_EMPTY = `## Workspace memory
 This workspace has shared long-lived memory, currently empty. Your context is lost when the session ends; memory is not. When you learn something durably useful — a preference, an environment fact, a procedure that worked, a decision and its reason — save it with memory_save (one crisp, self-contained fact per record). Never store secrets.`;
 
 export const MEMORY_SEARCH_TOOL_DESCRIPTION =
-  "Search this workspace's shared long-lived memory (semantic + keyword). Use it before starting a new non-trivial task when the injected notes or current conversation do not already answer how the workspace does something. Results persist in conversation context: do not repeat the same search as routine setup on every continuation, resume, or interrupted turn. Returns scored records with ids.";
-
-export const MEMORY_SAVE_TOOL_DESCRIPTION =
-  "Save one durable, future-useful fact to this workspace's shared memory: a stable preference, an environment fact, a procedure that worked, or a decision and its reason. Write it compactly (1–3 sentences), self-contained (no 'this session/above' references, absolute dates, name concrete things), so a future session can act on it alone. Do NOT save: session-specific state, speculation, anything derivable from the repo/docs, or near-duplicates of existing memories (search first — to refine or replace an existing record pass replaces_id). Most turns have nothing worth saving.";
-
-export const MEMORY_CORRECT_TOOL_DESCRIPTION =
-  "Flag a workspace memory as wrong or outdated the moment you discover it — this is the most valuable memory action, because a wrong memory misleads every future session. Pass the record's id (as shown in [brackets]); optionally give replacement_text with the corrected fact, otherwise the record is archived.";
+  "Search this workspace's shared long-lived memory (semantic + keyword). Use it before starting a new non-trivial task when the injected notes or current conversation do not already answer how the workspace does something. Results persist in conversation context: do not repeat the same search as routine setup on every continuation, resume, or interrupted turn. Returns scored records with ids. Indexed workspace documents are a separate store: search those with `knowledge_search`/`knowledge_get` (or `search_documents`) on the Document Search (docs) MCP server, not with this tool.";
 
 // ---------------------------------------------------------------------------
 // Text normalization + hashing (MUST match migration 0045 backfill exactly)
@@ -469,7 +463,7 @@ export function isMemoryTextTooLong(text: string): boolean {
 // ---------------------------------------------------------------------------
 
 export function estimateMemoryTokens(text: string): number {
-  return Math.ceil(text.length / 4);
+  return Math.ceil(Buffer.byteLength(text, "utf8") / 4);
 }
 
 // Short id shown in the block/tool output = first 8 chars of the uuid. Tools
@@ -491,46 +485,47 @@ export type MemoryBlockRecord = {
 // into kind sections. Episodic is excluded. Returns null if nothing renders
 // (no non-episodic records) — the caller substitutes the empty-state block.
 export function renderWorkspaceMemoryBlock(records: readonly MemoryBlockRecord[]): string | null {
-  const renderable = records.filter((record) => record.kind !== "episodic");
-  if (renderable.length === 0) {
+  if (!records.some((record) => record.kind !== "episodic")) {
     return null;
   }
+  const selected = selectWorkspaceMemoryBlockRecords(records);
+
+  const lines: string[] = [WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED];
+  for (const kind of MEMORY_BLOCK_KIND_ORDER) {
+    const inSection = selected.filter((record) => record.kind === kind);
+    if (inSection.length === 0) {
+      continue;
+    }
+    lines.push("", `### ${MEMORY_KIND_SECTION_TITLES[kind]}`);
+    for (const record of inSection) {
+      lines.push(renderMemoryEntry(record));
+    }
+  }
+  return lines.join("\n");
+}
 
-  // Greedy budget fill in priority order. We track the running token estimate of
-  // the whole block (header + section titles introduced so far + entries).
+/** Canonical whole-entry prompt-budget selector, shared with receipt validation. */
+export function selectWorkspaceMemoryBlockRecords(
+  records: readonly MemoryBlockRecord[],
+): readonly MemoryBlockRecord[] {
+  const renderable = records.filter((record) => record.kind !== "episodic");
   const headerTokens = estimateMemoryTokens(WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED);
   let usedTokens = headerTokens;
   const seenSections = new Set<KnowledgeMemoryKind>();
   const selected: MemoryBlockRecord[] = [];
   for (const record of renderable) {
     const entryLine = renderMemoryEntry(record);
-    let cost = estimateMemoryTokens(entryLine) + 1; // +1 for the entry's newline
+    let cost = estimateMemoryTokens(entryLine) + 1;
     if (!seenSections.has(record.kind)) {
       const sectionTitle = `### ${MEMORY_KIND_SECTION_TITLES[record.kind]}`;
-      cost += estimateMemoryTokens(sectionTitle) + 2; // title + blank line separator
-    }
-    if (usedTokens + cost > WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET) {
-      // Skip entries that don't fit instead of stopping: one oversized entry
-      // must not starve smaller lower-priority records of the remaining budget.
-      continue;
+      cost += estimateMemoryTokens(sectionTitle) + 2;
     }
+    if (usedTokens + cost > WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET) continue;
     usedTokens += cost;
     seenSections.add(record.kind);
     selected.push(record);
   }
-
-  const lines: string[] = [WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED];
-  for (const kind of MEMORY_BLOCK_KIND_ORDER) {
-    const inSection = selected.filter((record) => record.kind === kind);
-    if (inSection.length === 0) {
-      continue;
-    }
-    lines.push("", `### ${MEMORY_KIND_SECTION_TITLES[kind]}`);
-    for (const record of inSection) {
-      lines.push(renderMemoryEntry(record));
-    }
-  }
-  return lines.join("\n");
+  return selected;
 }
 
 function renderMemoryEntry(record: MemoryBlockRecord): string {

package/src/migrate.ts

@@ -6,6 +6,12 @@ import postgres from "postgres";
 const DEFAULT_DATABASE_URL = "postgres://opengeni:opengeni@127.0.0.1:5432/opengeni";
 const DEFAULT_MAX_NESTED_AGENT_DEPTH = 3;
 const MAX_NESTED_AGENT_DEPTH = 2_147_483_647;
+const DEFAULT_APPLICATION_DATABASE_ROLE = "opengeni_app";
+const GOAL_REVISION_CUTOVER_MIGRATION = "0257_goal_revision_decisions_and_root_constraints.sql";
+const ATOMIC_PERSONAL_RESOURCE_CUTOVER_MIGRATION = "0306_atomic_personal_resource_attachments.sql";
+const UNREGISTERED_INVITATION_CUTOVER_MIGRATION = "0314_unregistered_organization_invitations.sql";
+const ATOMIC_CONNECTED_MACHINE_CUTOVER_MIGRATION = "0338_atomic_connected_machine_attachments.sql";
+const MAX_MIGRATION_APPLICATION_ROLES = 16;
 const batchedBackfillDirective =
   /^-- opengeni:batched-backfill batch-size=(\d+) lock-timeout=(\d+(?:ms|s|min)) statement-timeout=(\d+(?:ms|s|min))$/;
 const concurrentIndexDirective = /^-- opengeni:concurrent-index lock-timeout=(\d+(?:ms|s|min))$/;
@@ -30,6 +36,12 @@ export interface ConcurrentIndexMigration {
 
 export type MigrationRuntimeOptions = {
   maxNestedAgentDepth?: number;
+  /**
+   * Exact database login roles that may run an OpenGeni API or worker against
+   * this target. Maintenance cutovers use this list to reject a live mixed-
+   * version fleet. Dedicated-schema and custom-role deployments must supply it.
+   */
+  applicationDatabaseRoles?: string[];
 };
 
 type DeploymentDepthPolicy = {
@@ -230,6 +242,53 @@ function deploymentDepthPolicy(
   return { maxNestedAgentDepth: value, source: "deployment" };
 }
 
+function migrationApplicationRoles(
+  schema: string | undefined,
+  options: MigrationRuntimeOptions | undefined,
+): string[] {
+  const configured = options?.applicationDatabaseRoles;
+  const environment = process.env.OPENGENI_MIGRATION_APPLICATION_DATABASE_ROLES?.trim();
+  const explicit =
+    configured !== undefined
+      ? configured
+      : environment
+        ? environment.split(",").map((role) => role.trim())
+        : undefined;
+
+  if (!explicit) {
+    const configuredRuntimeRoles = [
+      process.env.OPENGENI_APP_DATABASE_USER?.trim(),
+      process.env.OPENGENI_RUNTIME_DATABASE_ROLE?.trim(),
+    ].filter((role): role is string => Boolean(role) && role !== DEFAULT_APPLICATION_DATABASE_ROLE);
+    if (schema || configuredRuntimeRoles.length > 0) {
+      throw new Error(
+        "Migration 0257 requires the exact application database roles via " +
+          "MigrationRuntimeOptions.applicationDatabaseRoles or " +
+          "OPENGENI_MIGRATION_APPLICATION_DATABASE_ROLES for dedicated-schema or custom-role deployments",
+      );
+    }
+    return [DEFAULT_APPLICATION_DATABASE_ROLE];
+  }
+
+  if (explicit.length < 1 || explicit.length > MAX_MIGRATION_APPLICATION_ROLES) {
+    throw new Error(
+      `Migration application database roles must contain 1-${MAX_MIGRATION_APPLICATION_ROLES} entries`,
+    );
+  }
+  const normalized = [...new Set(explicit)].sort((left, right) =>
+    Buffer.compare(Buffer.from(left, "utf8"), Buffer.from(right, "utf8")),
+  );
+  if (
+    normalized.length !== explicit.length ||
+    normalized.some((role) => role.length === 0 || Buffer.byteLength(role, "utf8") > 63)
+  ) {
+    throw new Error(
+      "Migration application database roles must be unique, non-empty Postgres role names of at most 63 UTF-8 bytes",
+    );
+  }
+  return normalized;
+}
+
 async function persistDeploymentDepthPolicy(
   sql: postgres.Sql,
   policy: DeploymentDepthPolicy,
@@ -277,6 +336,9 @@ async function persistDeploymentDepthPolicy(
  *   2. `public` stays LAST on the path so `gen_random_uuid()` (pgcrypto) and the
  *      `vector` type — both installed into `public` by 0000 — still resolve. The
  *      `opengeni_private.*` helpers are always called with an absolute prefix.
+ * Dedicated-schema callers must also pass the exact API/worker database login
+ * identities in `applicationDatabaseRoles`; maintenance cutovers cannot infer
+ * host-managed or scoped runtime roles from the admin connection.
  *
  * `OPENGENI_DB_SCHEMA` defaults UNSET → `public` → standalone, so the default
  * binding never regresses.
@@ -312,6 +374,19 @@ export async function migrate(
     );
     const appliedRows = await sql`SELECT "name" FROM "schema_migrations"`;
     const applied = new Set(appliedRows.map((row) => row.name as string));
+    if (
+      !applied.has(GOAL_REVISION_CUTOVER_MIGRATION) ||
+      !applied.has(ATOMIC_PERSONAL_RESOURCE_CUTOVER_MIGRATION) ||
+      !applied.has(UNREGISTERED_INVITATION_CUTOVER_MIGRATION) ||
+      !applied.has(ATOMIC_CONNECTED_MACHINE_CUTOVER_MIGRATION)
+    ) {
+      const applicationRoles = migrationApplicationRoles(schema, runtimeOptions);
+      await sql`select set_config(
+        'opengeni.migration_application_roles',
+        ${JSON.stringify(applicationRoles)},
+        false
+      )`;
+    }
     for (const file of files) {
       if (applied.has(file)) {
         continue;
@@ -332,7 +407,8 @@ export async function migrate(
  * SDK entry point (Step I): run the migration chain over a host-supplied admin
  * connection string against an explicit target schema. This is the embedded
  * topology's named entry — a host calls `runMigrations(adminConnection,
- * targetSchema)` from its own provisioning code instead of relying on env vars.
+ * targetSchema, { applicationDatabaseRoles })` from its own provisioning code
+ * instead of relying on env vars.
  * `targetSchema` undefined → `public` → standalone behavior. Thin wrapper over
  * `migrate` so there is one migration engine.
  */

package/src/new-session-drafts.ts

@@ -1,17 +1,44 @@
 import type {
   NewSessionDraftOptions,
+  NewSessionSelectionHistory,
   LatencyMode,
   ReasoningEffort,
   RepositoryResourceRef,
   ResourceRef,
   ToolRef,
 } from "@opengeni/contracts";
-import { and, eq } from "drizzle-orm";
+import { stableJson } from "@opengeni/contracts";
+import { and, eq, sql } from "drizzle-orm";
 import type { Database } from "./database";
 import * as schema from "./schema";
+import {
+  accountIdInRlsScope,
+  subjectHasLiveWorkspaceAuthorityInScope,
+} from "./workspace-authority";
 
 export type NewSessionDraftRow = typeof schema.newSessionDrafts.$inferSelect;
 
+async function lockNewSessionDraftIdentity(
+  db: Database,
+  workspaceId: string,
+  subjectId: string,
+): Promise<void> {
+  await db.execute(
+    sql`select pg_advisory_xact_lock(hashtextextended(${`new-session-draft:${workspaceId}:${subjectId}`}, 0))`,
+  );
+}
+
+export type NewSessionDraftSnapshot = {
+  text: string;
+  resources: ResourceRef[];
+  tools: ToolRef[];
+  toolsProvided: boolean;
+  model: string;
+  reasoningEffort: ReasoningEffort;
+  latencyMode: LatencyMode;
+  options: NewSessionDraftOptions;
+};
+
 export class NewSessionDraftConflictError extends Error {
   readonly name = "NewSessionDraftConflictError";
 
@@ -31,13 +58,54 @@ export class NewSessionDraftAccessError extends Error {
 type StoredNewSessionDraftOptions = NewSessionDraftOptions & {
   /** JSONB-only compatibility marker; deliberately not part of public options. */
   toolsProvided?: boolean;
+  /** Successful-create preference state, separate from transient draft edits. */
+  selectionHistory?: NewSessionSelectionHistory;
 };
 
+const REMEMBERED_WORKING_DIR_MAX_LENGTH = 4096;
+
 function storedOptions(
   options: NewSessionDraftOptions,
   toolsProvided: boolean,
+  selectionHistory: NewSessionSelectionHistory = { projects: [] },
 ): StoredNewSessionDraftOptions {
-  return { ...options, toolsProvided };
+  return { ...options, toolsProvided, selectionHistory };
+}
+
+export function newSessionSelectionHistory(row: NewSessionDraftRow): NewSessionSelectionHistory {
+  const raw = (row.sessionOptions as StoredNewSessionDraftOptions).selectionHistory;
+  if (!raw || !Array.isArray(raw.projects)) return { projects: [] };
+  return {
+    projects: raw.projects.slice(0, 50).flatMap((project) => {
+      if (!project || (project.channelId !== null && typeof project.channelId !== "string")) {
+        return [];
+      }
+      return [
+        {
+          channelId: project.channelId,
+          targetSandboxId:
+            typeof project.targetSandboxId === "string" ? project.targetSandboxId : null,
+          machines: Array.isArray(project.machines)
+            ? project.machines.slice(0, 20).flatMap((machine) =>
+                machine && typeof machine.sandboxId === "string"
+                  ? [
+                      {
+                        sandboxId: machine.sandboxId,
+                        workingDir:
+                          typeof machine.workingDir === "string" &&
+                          machine.workingDir.length > 0 &&
+                          machine.workingDir.length <= REMEMBERED_WORKING_DIR_MAX_LENGTH
+                            ? machine.workingDir
+                            : null,
+                      },
+                    ]
+                  : [],
+              )
+            : [],
+        },
+      ];
+    }),
+  };
 }
 
 export function newSessionDraftToolsProvided(row: NewSessionDraftRow): boolean {
@@ -53,6 +121,7 @@ export function newSessionDraftToolsProvided(row: NewSessionDraftRow): boolean {
 export function publicNewSessionDraftOptions(row: NewSessionDraftRow): NewSessionDraftOptions {
   const options = { ...(row.sessionOptions as StoredNewSessionDraftOptions) };
   delete options.toolsProvided;
+  delete options.selectionHistory;
   return options;
 }
 
@@ -87,10 +156,16 @@ export async function saveNewSessionDraftInTransaction(
     toolsProvided: boolean;
     model: string;
     reasoningEffort: ReasoningEffort;
-    latencyMode?: LatencyMode;
+    latencyMode: LatencyMode;
     options: NewSessionDraftOptions;
     /** API-key and delegated service subjects have no workspace-membership row. */
     requireWorkspaceMembership?: boolean;
+    /**
+     * May this caller use the owner-only managed personal-workspace exception?
+     * See `PersonalWorkspaceOwnerException` in `@opengeni/db`. Absent means the
+     * historical bare-membership fence, unchanged.
+     */
+    personalWorkspaceOwnerException?: boolean;
   },
 ): Promise<NewSessionDraftRow> {
   if (input.requireWorkspaceMembership !== false) {
@@ -109,9 +184,36 @@ export async function saveNewSessionDraftInTransaction(
       )
       .for("key share")
       .limit(1);
-    if (!membership) throw new NewSessionDraftAccessError();
+    // The owner of a managed personal workspace never has a membership row there
+    // (migration 0219 raises on one), so the bare probe above would 403 the
+    // composer inside the one workspace they always belong to. Ask the canonical
+    // resolver instead of re-deriving that rule — it runs on this same
+    // transaction handle, and there is no membership row for removeWorkspaceMember()
+    // to delete in a personal workspace, so nothing is lost by taking no
+    // `FOR KEY SHARE` on this path.
+    if (
+      !membership &&
+      !(
+        input.personalWorkspaceOwnerException === true &&
+        (await subjectHasLiveWorkspaceAuthorityInScope(db, {
+          // Scope-derived, NOT `input.accountId`: the applied RLS GUC is the
+          // tenant this transaction actually runs under, so an authority
+          // decision never reads a caller-supplied account. Matches
+          // listSessionsForSubject and setSessionPin.
+          accountId: await accountIdInRlsScope(db),
+          workspaceId: input.workspaceId,
+          subjectId: input.subjectId,
+        }))
+      )
+    ) {
+      throw new NewSessionDraftAccessError();
+    }
   }
-  const current = await getNewSessionDraftInTransaction(db, { ...input, lock: true });
+  await lockNewSessionDraftIdentity(db, input.workspaceId, input.subjectId);
+  const current = await getNewSessionDraftInTransaction(db, {
+    ...input,
+    lock: true,
+  });
   const currentRevision = current?.revision ?? 0;
   if (currentRevision !== input.expectedRevision) {
     throw new NewSessionDraftConflictError(currentRevision);
@@ -128,10 +230,14 @@ export async function saveNewSessionDraftInTransaction(
     tools: input.tools,
     model: input.model,
     reasoningEffort: input.reasoningEffort,
-    latencyMode: input.latencyMode ?? "standard",
+    latencyMode: input.latencyMode,
     // Keep the explicit/omitted policy in the existing JSONB extension point;
     // adding a column here would turn a client preference into a migration.
-    sessionOptions: storedOptions(input.options, input.toolsProvided),
+    sessionOptions: storedOptions(
+      input.options,
+      input.toolsProvided,
+      current ? newSessionSelectionHistory(current) : { projects: [] },
+    ),
     updatedAt: new Date(),
   };
   if (current) {
@@ -155,7 +261,10 @@ export async function saveNewSessionDraftInTransaction(
     })
     .returning();
   if (inserted) return inserted;
-  const raced = await getNewSessionDraftInTransaction(db, { ...input, lock: true });
+  const raced = await getNewSessionDraftInTransaction(db, {
+    ...input,
+    lock: true,
+  });
   throw new NewSessionDraftConflictError(raced?.revision ?? 0);
 }
 
@@ -177,38 +286,94 @@ function safeRepositoryResource(resource: RepositoryResourceRef): RepositoryReso
   };
 }
 
-function safeWorkingDir(value: unknown, targetSandboxId: string | undefined): string | undefined {
-  if (!targetSandboxId || typeof value !== "string") return undefined;
-  const trimmed = value.trim();
-  // Only a workspace-root-relative path is safe to remember. Absolute host
-  // paths and traversal would leak or unexpectedly target a different machine
-  // location after the user changes machines.
-  if (
-    !trimmed ||
-    trimmed === "." ||
-    trimmed === ".." ||
-    trimmed.includes("\u0000") ||
-    trimmed.startsWith("/") ||
-    trimmed.startsWith("\\") ||
-    /^[A-Za-z]:[\\/]/.test(trimmed) ||
-    trimmed.split(/[\\/]+/).some((part) => part === "..")
-  ) {
-    return undefined;
+export type AcceptedNewSessionSelection = {
+  channelId: string | null;
+  targetSandboxId: string | null;
+  workingDir: string | null;
+};
+
+export function rememberNewSessionSelection(
+  history: NewSessionSelectionHistory,
+  selection: AcceptedNewSessionSelection,
+): NewSessionSelectionHistory {
+  const existingProject = history.projects.find(
+    (project) => project.channelId === selection.channelId,
+  );
+  let machines = existingProject?.machines ?? [];
+  if (selection.targetSandboxId) {
+    machines = [
+      {
+        sandboxId: selection.targetSandboxId,
+        workingDir:
+          selection.workingDir && selection.workingDir.length <= REMEMBERED_WORKING_DIR_MAX_LENGTH
+            ? selection.workingDir
+            : null,
+      },
+      ...machines.filter((machine) => machine.sandboxId !== selection.targetSandboxId),
+    ].slice(0, 20);
   }
-  return trimmed;
+  return {
+    projects: [
+      {
+        channelId: selection.channelId,
+        targetSandboxId: selection.targetSandboxId,
+        machines,
+      },
+      ...history.projects.filter((project) => project.channelId !== selection.channelId),
+    ].slice(0, 50),
+  };
+}
+
+/**
+ * Record a successful create without consuming the editable draft. Realtime
+ * session creation uses this path because it must preserve the actor's pending
+ * text/files for a later ordinary session. The hidden preference update shares
+ * the draft identity lock with saves, and deliberately leaves its OCC revision
+ * unchanged because no browser-editable field changed.
+ */
+export async function rememberNewSessionSelectionInTransaction(
+  db: Database,
+  input: {
+    workspaceId: string;
+    subjectId: string;
+    acceptedSelection: AcceptedNewSessionSelection;
+  },
+): Promise<boolean> {
+  await lockNewSessionDraftIdentity(db, input.workspaceId, input.subjectId);
+  const current = await getNewSessionDraftInTransaction(db, { ...input, lock: true });
+  if (!current) return false;
+  const [updated] = await db
+    .update(schema.newSessionDrafts)
+    .set({
+      sessionOptions: storedOptions(
+        publicNewSessionDraftOptions(current),
+        newSessionDraftToolsProvided(current),
+        rememberNewSessionSelection(newSessionSelectionHistory(current), input.acceptedSelection),
+      ),
+    })
+    .where(eq(schema.newSessionDrafts.id, current.id))
+    .returning({ id: schema.newSessionDrafts.id });
+  return Boolean(updated);
 }
 
 /**
  * Replace one exact accepted draft with the next-create safe seed. The row is
- * locked before the revision check so a concurrent save either commits first
- * and wins (this returns false), or observes the incremented seed revision and
- * reports a typed OCC conflict. A missing row is an idempotent no-op.
+ * identity-serialized before the revision check so even the absent-row
+ * revision-zero case cannot race a first save. Exact create callers receive a
+ * typed conflict; legacy revision-only callers retain the old false/no-op
+ * result. A missing row is an idempotent no-op.
  */
 export async function seedNewSessionDraftInTransaction(
   db: Database,
-  input: { workspaceId: string; subjectId: string; expectedRevision: number },
+  input: {
+    workspaceId: string;
+    subjectId: string;
+    expectedRevision: number;
+    expectedSnapshot?: NewSessionDraftSnapshot;
+    acceptedSelection?: AcceptedNewSessionSelection;
+  },
 ): Promise<boolean> {
-  if (input.expectedRevision === 0) return false;
+  await lockNewSessionDraftIdentity(db, input.workspaceId, input.subjectId);
   const [current] = await db
     .select()
     .from(schema.newSessionDrafts)
@@ -220,7 +385,27 @@ export async function seedNewSessionDraftInTransaction(
     )
     .for("update")
     .limit(1);
-  if (!current || current.revision !== input.expectedRevision) return false;
+  if (!current || current.revision !== input.expectedRevision) {
+    if (input.expectedSnapshot) {
+      throw new NewSessionDraftConflictError(current?.revision ?? 0);
+    }
+    return false;
+  }
+  if (
+    input.expectedSnapshot &&
+    stableJson({
+      text: current.text,
+      resources: current.resources,
+      tools: newSessionDraftToolsProvided(current) ? current.tools : [],
+      toolsProvided: newSessionDraftToolsProvided(current),
+      model: current.model,
+      reasoningEffort: current.reasoningEffort,
+      latencyMode: current.latencyMode,
+      options: publicNewSessionDraftOptions(current),
+    }) !== stableJson(input.expectedSnapshot)
+  ) {
+    throw new NewSessionDraftConflictError(current.revision);
+  }
 
   const options = current.sessionOptions as StoredNewSessionDraftOptions;
   const targetSandboxId =
@@ -228,8 +413,8 @@ export async function seedNewSessionDraftInTransaction(
   const safeOptions: NewSessionDraftOptions = {
     ...(options.sandboxBackend ? { sandboxBackend: options.sandboxBackend } : {}),
     ...(targetSandboxId ? { targetSandboxId } : {}),
-    ...(safeWorkingDir(options.workingDir, targetSandboxId)
-      ? { workingDir: safeWorkingDir(options.workingDir, targetSandboxId) }
+    ...(targetSandboxId && typeof options.workingDir === "string"
+      ? { workingDir: options.workingDir }
       : {}),
     ...(options.variableSetId ? { variableSetId: options.variableSetId } : {}),
     ...(options.rigId ? { rigId: options.rigId } : {}),
@@ -252,7 +437,16 @@ export async function seedNewSessionDraftInTransaction(
       model: current.model,
       reasoningEffort: current.reasoningEffort,
       latencyMode: current.latencyMode,
-      sessionOptions: storedOptions(safeOptions, newSessionDraftToolsProvided(current)),
+      sessionOptions: storedOptions(
+        safeOptions,
+        newSessionDraftToolsProvided(current),
+        input.acceptedSelection
+          ? rememberNewSessionSelection(
+              newSessionSelectionHistory(current),
+              input.acceptedSelection,
+            )
+          : newSessionSelectionHistory(current),
+      ),
       updatedAt: new Date(),
     })
     .where(