@opengeni/db 0.9.3 → 0.10.7

package/src/schema.ts

@@ -1,5 +1,6 @@
-import type { McpServerConnectionRef } from "@opengeni/contracts";
+import type { McpServerConnectionRef, SessionMcpApprovalPolicy } from "@opengeni/contracts";
 import { sql } from "drizzle-orm";
+import type { SessionToolPolicy } from "@opengeni/contracts";
 import type { HumanInputQuestion, HumanInputResponse } from "@opengeni/contracts";
 import {
   bigint,
@@ -320,6 +321,19 @@ export const codexSubscriptionCredentials = pgTable(
     // refresh, encrypted material, and already-frozen/in-flight turns are
     // intentionally independent. account eligibility policy owns toggle OCC/audit and product UI.
     allocatorEnabled: boolean("allocator_enabled").notNull().default(true),
+    // Independent OCC/audit sequence for the allocator toggle. Token refresh
+    // continues to own `version`; quota/cache writes own neither counter.
+    allocatorVersion: integer("allocator_version").notNull().default(1),
+    allocatorUpdatedBySubjectId: text("allocator_updated_by_subject_id"),
+    allocatorUpdatedAt: timestamp("allocator_updated_at", { withTimezone: true }),
+    // Authoritative count-only summary cached from /wham/usage. Detailed rows
+    // are never persisted as redemption authority; every first POST preflights
+    // the provider's fresh detail endpoint.
+    resetCreditAvailableCount: integer("reset_credit_available_count"),
+    resetCreditsCheckedAt: timestamp("reset_credits_checked_at", { withTimezone: true }),
+    // Set only by a direct Better Auth cookie connection/reconnection. Legacy,
+    // configured, delegated, API-key, and agent-created rows remain view-only.
+    connectedBySubjectId: text("connected_by_subject_id"),
     selectionCount: integer("selection_count").notNull().default(0),
     lastSelectedAt: timestamp("last_selected_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -343,6 +357,82 @@ export const codexSubscriptionCredentials = pgTable(
   }),
 );
 
+// One durable logical human redemption. `processing` means the fresh provider
+// detail preflight is still owed; `provider_started` means the POST may have
+// reached upstream and every retry must reuse upstreamIdempotencyKey without
+// requiring the credit to remain visible as available.
+export const codexResetRedemptionAttempts = pgTable(
+  "codex_reset_redemption_attempts",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    credentialId: uuid("credential_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    browserSessionHash: text("browser_session_hash").notNull(),
+    creditId: text("credit_id").notNull(),
+    upstreamIdempotencyKey: uuid("upstream_idempotency_key").notNull().defaultRandom(),
+    status: text("status").notNull().default("processing"),
+    outcome: text("outcome"),
+    claimHolderId: uuid("claim_holder_id"),
+    claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }),
+    confirmationExpiresAt: timestamp("confirmation_expires_at", { withTimezone: true }).notNull(),
+    providerStartedAt: timestamp("provider_started_at", { withTimezone: true }),
+    completedAt: timestamp("completed_at", { withTimezone: true }),
+    lastFailureKind: text("last_failure_kind"),
+    retryCount: integer("retry_count").notNull().default(0),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "codex_reset_redemption_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    upstreamKey: uniqueIndex("codex_reset_redemption_upstream_key_idx").on(
+      table.upstreamIdempotencyKey,
+    ),
+    credentialCredit: uniqueIndex("codex_reset_redemption_credential_credit_idx")
+      .on(table.workspaceId, table.credentialId, table.creditId)
+      .where(
+        sql`${table.status} <> 'completed' or ${table.outcome} in ('reset', 'alreadyRedeemed')`,
+      ),
+    workspaceCredential: index("codex_reset_redemption_workspace_credential_idx").on(
+      table.workspaceId,
+      table.credentialId,
+      table.createdAt,
+    ),
+    claimExpiry: index("codex_reset_redemption_claim_expiry_idx")
+      .on(table.claimExpiresAt)
+      .where(sql`${table.status} <> 'completed'`),
+    statusValid: check(
+      "codex_reset_redemption_status_check",
+      sql`${table.status} in ('processing', 'provider_started', 'completed')`,
+    ),
+    outcomeValid: check(
+      "codex_reset_redemption_outcome_check",
+      sql`${table.outcome} is null or ${table.outcome} in ('reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed')`,
+    ),
+    completionConsistent: check(
+      "codex_reset_redemption_completed_check",
+      sql`(${table.status} = 'completed') = (${table.outcome} is not null and ${table.completedAt} is not null)`,
+    ),
+    retryCountValid: check(
+      "codex_reset_redemption_retry_count_check",
+      sql`${table.retryCount} >= 0`,
+    ),
+    humanSubjectValid: check(
+      "codex_reset_redemption_human_subject_check",
+      sql`${table.subjectId} like 'user:_%'`,
+    ),
+  }),
+);
+
 // Generic external-service credential spine. credential_encrypted is the ONLY
 // secret-bearing column; normal API reads use metadata-only helpers below the DB
 // layer. Runtime token material is decrypted only by the broker accessor.
@@ -634,6 +724,10 @@ export const sessions = pgTable(
     // Non-default first-party MCP token permissions (manager-style sessions);
     // null means the fixed worker default set in @opengeni/runtime.
     firstPartyMcpPermissions: jsonb("first_party_mcp_permissions").$type<string[]>(),
+    // Durable tool-policy origin. NULL is retained for pre-migration rows;
+    // mapSession exposes those rows as `legacy` instead of guessing omitted vs
+    // explicit [].
+    toolPolicy: jsonb("tool_policy").$type<SessionToolPolicy>(),
     // The manager session that spawned this one via session_create. Set only
     // when the creating grant carried a worker-signed sessionId claim (a session
     // spawning a worker); null for direct API creates and scheduled-task runs.
@@ -1156,6 +1250,9 @@ export const sessionTurns = pgTable(
     turnInstructions: text("turn_instructions"),
     resources: jsonb("resources").$type<unknown[]>().notNull().default([]),
     tools: jsonb("tools").$type<unknown[]>().notNull().default([]),
+    // false = inherit the durable session policy; true = this turn explicitly
+    // replaces it with `tools` after the core subset fence.
+    toolsProvided: boolean("tools_provided").notNull().default(false),
     model: text("model").notNull(),
     reasoningEffort: text("reasoning_effort").notNull(),
     sandboxBackend: text("sandbox_backend").notNull(),
@@ -1230,6 +1327,10 @@ export const sessionTurnAttempts = pgTable(
     verifiedControlRevision: bigint("verified_control_revision", {
       mode: "number",
     }).notNull(),
+    // Immutable policy snapshot captured under the session lock at claim.
+    mcpApprovalPolicies: jsonb("mcp_approval_policies")
+      .$type<Record<string, SessionMcpApprovalPolicy>>()
+      .notNull(),
     startedAt: timestamp("started_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
     closedAt: timestamp("closed_at", { withTimezone: true }),
@@ -1502,6 +1603,7 @@ export const composerDrafts = pgTable(
     text: text("text").notNull().default(""),
     resources: jsonb("resources").$type<unknown[]>().notNull().default([]),
     tools: jsonb("tools").$type<unknown[]>().notNull().default([]),
+    toolsProvided: boolean("tools_provided").notNull().default(false),
     model: text("model").notNull(),
     reasoningEffort: text("reasoning_effort").notNull(),
     sourceTurnId: uuid("source_turn_id"),
@@ -2999,6 +3101,10 @@ export const hostExportOutbox = pgTable(
       "host_export_outbox_kind_check",
       sql`${table.exportKind} in ('session_event', 'usage_event')`,
     ),
+    rootSessionCaptured: check(
+      "host_export_outbox_root_session_check",
+      sql`${table.sessionId} is null or ${table.rootSessionId} is not null`,
+    ),
     sourceUnique: uniqueIndex("host_export_outbox_source_uq").on(table.exportKind, table.sourceId),
     cursorUnique: uniqueIndex("host_export_outbox_cursor_uq")
       .on(table.exportKind, table.exportCursor)

package/src/session-control.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import {
   boundWorkspaceControlEvent,
   workspaceControlUtf8Bytes,
+  type SessionMcpApprovalPolicy,
   type TurnInitiatorContext,
 } from "@opengeni/contracts";
 import { and, eq, inArray, sql } from "drizzle-orm";
@@ -512,6 +513,7 @@ export async function registerSessionTurnAttemptClaim(
     temporalWorkflowRunId: string;
     temporalActivityId: string;
     verifiedControlRevision: number;
+    mcpApprovalPolicies: Record<string, SessionMcpApprovalPolicy>;
   },
 ): Promise<typeof schema.sessionTurnAttempts.$inferSelect> {
   const [inserted] = await db

package/src/session-queue-commands.ts

@@ -1,9 +1,13 @@
 import {
+  metadataWithTurnExecutionPolicyV1,
   mergeResourceRefs,
   mergeToolRefs,
+  turnExecutionPolicyAuditMetadata,
   type ReasoningEffort,
   type ResourceRef,
+  type SessionToolPolicy,
   type ToolRef,
+  type TurnExecutionPolicyV1,
 } from "@opengeni/contracts";
 import { and, asc, eq, inArray, sql } from "drizzle-orm";
 import type { Database } from "./index";
@@ -39,7 +43,8 @@ export type QueueCommandConflictCode =
   | "QUEUE_ANCHOR_CHANGED"
   | "PROMPT_CHANGED"
   | "DRAFT_CHANGED"
-  | "DRAFT_NOT_EMPTY";
+  | "DRAFT_NOT_EMPTY"
+  | "EDIT_SOURCE_CHANGED";
 
 export class QueueCommandConflictError extends Error {
   readonly name = "QueueCommandConflictError";
@@ -377,6 +382,7 @@ function draftIsNonEmpty(draft: ComposerDraftRow): boolean {
     draft.text.length > 0 ||
     draft.resources.length > 0 ||
     draft.tools.length > 0 ||
+    draft.toolsProvided ||
     draft.sourceTurnId !== null
   );
 }
@@ -416,6 +422,7 @@ export async function saveComposerDraftInTransaction(
     text: string;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided: boolean;
     model: string;
     reasoningEffort: ReasoningEffort;
   },
@@ -447,6 +454,7 @@ export async function saveComposerDraftInTransaction(
     text: input.text,
     resources: input.resources,
     tools: input.tools,
+    toolsProvided: input.toolsProvided,
     model: input.model,
     reasoningEffort: input.reasoningEffort,
     // A queue edit is still the same accepted work item. Preserve its frozen
@@ -818,6 +826,7 @@ export async function editQueuedTurnInTransaction(
     text: turn.prompt,
     resources: turn.resources,
     tools: turn.tools,
+    toolsProvided: turn.toolsProvided,
     model: turn.model,
     reasoningEffort: turn.reasoningEffort,
     sourceTurnId: turn.id,
@@ -1134,9 +1143,12 @@ export async function submitHumanPromptInTransaction(
     turnInstructions?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided?: boolean;
     model?: string | null;
     reasoningEffort?: ReasoningEffort | null;
     reasoningEffortFallback: ReasoningEffort;
+    /** Trusted API/core admission snapshot. Omitted only by legacy low-level callers. */
+    turnExecutionPolicy?: TurnExecutionPolicyV1;
     source: "user" | "api";
     mcpCredentialUpdates?: Array<{
       id: string;
@@ -1163,6 +1175,7 @@ export async function submitHumanPromptInTransaction(
     turnInstructions: input.turnInstructions ?? null,
     resources: input.resources,
     tools: input.tools,
+    toolsProvided: input.toolsProvided === true,
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
     source: input.source,
@@ -1271,6 +1284,7 @@ export async function submitHumanPromptInTransaction(
         text: draft.text,
         resources: draft.resources,
         tools: draft.tools,
+        toolsProvided: draft.toolsProvided,
         model: draft.model,
         reasoningEffort: draft.reasoningEffort,
       }) !==
@@ -1278,6 +1292,7 @@ export async function submitHumanPromptInTransaction(
           text: input.text,
           resources: input.resources,
           tools: input.tools,
+          toolsProvided: input.toolsProvided === true,
           model: input.model ?? session.model,
           reasoningEffort: input.reasoningEffort ?? input.reasoningEffortFallback,
         })
@@ -1293,6 +1308,52 @@ export async function submitHumanPromptInTransaction(
     }
   }
 
+  let editedSourceTurn: QueuedTurnRow | undefined;
+  let editedSourceTurnInstructions: string | null | undefined;
+  if (draft?.sourceTurnId) {
+    const sourceLocks = await lockSessionEventWriteRows(db, {
+      workspaceId: input.workspaceId,
+      controlLock: "already_locked",
+      workspaceLock: "already_locked",
+      turnIds: [draft.sourceTurnId],
+    });
+    const sourceTurn = sourceLocks.turns[0];
+    const sourceTurnVersion = draft.sourceTurnVersion;
+    const sourceMetadata = sourceTurn?.metadata ?? {};
+    const sourceIsExactWithdrawnRevision =
+      sourceTurn !== undefined &&
+      sourceTurn.accountId === input.accountId &&
+      sourceTurn.workspaceId === input.workspaceId &&
+      sourceTurn.sessionId === input.sessionId &&
+      (sourceTurn.source === "user" || sourceTurn.source === "api") &&
+      sourceTurn.status === "withdrawn_for_edit" &&
+      sourceTurnVersion !== null &&
+      sourceTurn.version === sourceTurnVersion + 1 &&
+      sourceTurn.cancelledBy === input.subjectId &&
+      sourceTurn.cancelReason === "withdrawn_for_edit" &&
+      sourceTurn.activeAttemptId === null &&
+      sourceMetadata.delivery !== "steer";
+    if (!sourceIsExactWithdrawnRevision) {
+      throw new QueueCommandConflictError(
+        "EDIT_SOURCE_CHANGED",
+        "Edited prompt source changed or is no longer withdrawn for edit",
+        {
+          queueVersion: session.queueVersion,
+          draftRevision: draft.revision,
+          ...(sourceTurn ? { turnVersion: sourceTurn.version } : {}),
+        },
+      );
+    }
+    // This is the sole private-instruction source for an edited replacement.
+    // It is deliberately held separately from the public draft and event
+    // projections below. The public draft is expected to differ after editing;
+    // source identity is fenced by its exact withdrawn row version, not by
+    // comparing the replacement content with the old prompt. A client-supplied
+    // instruction value must never override the private source value.
+    editedSourceTurn = sourceTurn;
+    editedSourceTurnInstructions = sourceTurn.turnInstructions ?? null;
+  }
+
   for (const update of input.mcpCredentialUpdates ?? []) {
     const [server] = await db
       .update(schema.sessionMcpServers)
@@ -1315,22 +1376,7 @@ export async function submitHumanPromptInTransaction(
   const now = new Date();
   let frozenInitiator: FrozenTurnInitiator;
   if (input.delivery === "send" && draft?.sourceTurnId) {
-    const [sourceTurn] = await db
-      .select({
-        sessionId: schema.sessionTurns.sessionId,
-        initiatorKind: schema.sessionTurns.initiatorKind,
-        initiatorSubjectId: schema.sessionTurns.initiatorSubjectId,
-        initiatorContext: schema.sessionTurns.initiatorContext,
-      })
-      .from(schema.sessionTurns)
-      .where(
-        and(
-          eq(schema.sessionTurns.workspaceId, input.workspaceId),
-          eq(schema.sessionTurns.sessionId, input.sessionId),
-          eq(schema.sessionTurns.id, draft.sourceTurnId),
-        ),
-      )
-      .limit(1);
+    const sourceTurn = editedSourceTurn;
     if (!sourceTurn) {
       throw new SessionControlInvariantError("Edited prompt source turn is missing");
     }
@@ -1366,7 +1412,11 @@ export async function submitHumanPromptInTransaction(
       payload: sanitizeEventPayload({
         text: input.text,
         ...(input.resources.length ? { resources: input.resources } : {}),
-        ...(input.tools.length ? { tools: input.tools } : {}),
+        ...(input.toolsProvided === true
+          ? { tools: input.tools }
+          : input.tools.length
+            ? { tools: input.tools }
+            : {}),
         ...(input.model ? { model: input.model } : {}),
         ...(input.reasoningEffort ? { reasoningEffort: input.reasoningEffort } : {}),
         delivery: input.delivery,
@@ -1389,13 +1439,19 @@ export async function submitHumanPromptInTransaction(
       source: input.source,
       position: input.delivery === "steer" ? 0 : existingQueued.length + 1,
       prompt: input.text,
-      turnInstructions: input.turnInstructions ?? null,
+      turnInstructions:
+        editedSourceTurnInstructions !== undefined
+          ? editedSourceTurnInstructions
+          : (input.turnInstructions ?? null),
       resources: input.resources,
       tools: input.tools,
+      toolsProvided: input.toolsProvided === true,
       model: input.model ?? session.model,
       reasoningEffort: input.reasoningEffort ?? input.reasoningEffortFallback,
       sandboxBackend: session.sandboxBackend,
-      metadata: {},
+      metadata: input.turnExecutionPolicy
+        ? metadataWithTurnExecutionPolicyV1({}, input.turnExecutionPolicy)
+        : {},
       lineage: { actor: input.actor.type },
       ...initiatorColumns(frozenInitiator),
     })
@@ -1455,6 +1511,7 @@ export async function submitHumanPromptInTransaction(
       .update(schema.sessionTurns)
       .set({
         metadata: {
+          ...turn.metadata,
           delivery: "steer",
           replacedTurnId,
           replacedAttemptId,
@@ -1532,7 +1589,9 @@ export async function submitHumanPromptInTransaction(
     .update(schema.sessions)
     .set({
       resources: mergeResourceRefs(session.resources as ResourceRef[], input.resources),
-      tools: mergeToolRefs(session.tools as ToolRef[], input.tools),
+      tools: sessionToolPolicyIsFixed(session.toolPolicy)
+        ? session.tools
+        : mergeToolRefs(session.tools as ToolRef[], input.tools),
       activeTurnId: input.delivery === "steer" ? liveCurrentTurnId : session.activeTurnId,
       status: nextStatus,
       queueVersion,
@@ -1566,6 +1625,9 @@ export async function submitHumanPromptInTransaction(
       operationId: reserved.receipt.id,
       replacedTurnId,
       interruptionCount,
+      ...(input.turnExecutionPolicy
+        ? turnExecutionPolicyAuditMetadata(input.turnExecutionPolicy, turnId)
+        : {}),
     },
   });
   const eventIds = eventRows.map((event) => event.id);
@@ -1582,6 +1644,11 @@ export async function submitHumanPromptInTransaction(
       interruptionCount,
       replacedTurnId,
       workspaceControlEventId: resumed.workspaceControlEventId,
+      ...(input.turnExecutionPolicy
+        ? {
+            executionPolicy: turnExecutionPolicyAuditMetadata(input.turnExecutionPolicy, turnId),
+          }
+        : {}),
     },
   });
   return {
@@ -1597,6 +1664,12 @@ export async function submitHumanPromptInTransaction(
   };
 }
 
+function sessionToolPolicyIsFixed(value: unknown): boolean {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const mode = (value as Partial<SessionToolPolicy>).mode;
+  return mode === "workspace_default" || mode === "explicit" || mode === "inherited";
+}
+
 export async function sendAgentMessageInTransaction(
   db: Database,
   input: {