@opengeni/db 1.3.0 → 1.4.0

package/src/legacy-tool-action-reviews.ts

@@ -0,0 +1,242 @@
+import { createHash } from "node:crypto";
+import { and, desc, eq, gt, isNull, sql } from "drizzle-orm";
+import { parseVerifiedAttemptToolCatalog } from "@opengeni/codemode";
+import {
+  McpConnectionAccountBindings,
+  ToolActionReview,
+  decodeReviewArguments,
+  ToolDisplayMetadata,
+  stableJson,
+  toolReviewAction,
+  toolReviewContextFromSchema,
+  toolReviewFields,
+  type ToolReviewContext,
+} from "@opengeni/contracts";
+import { type Database, withRlsContext } from "./database";
+import { fromPostgresLosslessJson } from "./lossless-json";
+import * as schema from "./schema";
+
+const object = (value: unknown): Record<string, unknown> | null =>
+  value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+
+function approval(value: unknown) {
+  const item = object(value);
+  const raw = object(item?.rawItem);
+  if (!item) return null;
+  return {
+    id: raw?.callId ?? raw?.id ?? item.id ?? item.callId,
+    name: item.name ?? item.toolName ?? raw?.name,
+    args: decodeReviewArguments(item.arguments ?? raw?.arguments),
+  };
+}
+
+/** Read-only presentation for SDK approvals created before durable connector
+ * reviews. Neither current catalogs nor display labels establish a provider.
+ * This never creates a request, changes a policy, or resumes an operation. */
+export async function legacyToolActionReview(
+  db: Database,
+  input: { accountId: string; workspaceId: string; sessionId: string; approvalId: string },
+) {
+  return await withRlsContext(db, input, async (tx) => {
+    const [snapshot] = await tx
+      .select({
+        state: {
+          id: schema.agentRunStates.id,
+          pending: schema.agentRunStates.pendingApprovals,
+          codec: schema.agentRunStates.pendingApprovalsCodecVersion,
+        },
+        turn: schema.sessionTurns,
+        session: { status: schema.sessions.status, activeTurnId: schema.sessions.activeTurnId },
+      })
+      .from(schema.agentRunStates)
+      .innerJoin(schema.sessionTurns, eq(schema.sessionTurns.id, schema.agentRunStates.turnId))
+      .innerJoin(schema.sessions, eq(schema.sessions.id, schema.agentRunStates.sessionId))
+      .where(
+        and(
+          eq(schema.agentRunStates.accountId, input.accountId),
+          eq(schema.agentRunStates.workspaceId, input.workspaceId),
+          eq(schema.agentRunStates.sessionId, input.sessionId),
+        ),
+      )
+      .orderBy(desc(schema.agentRunStates.stateVersion))
+      .limit(1);
+    if (!snapshot) return null;
+    const pending = fromPostgresLosslessJson(snapshot.state.pending, snapshot.state.codec);
+    const matching = Array.isArray(pending)
+      ? pending.map(approval).filter((item) => item?.id === input.approvalId)
+      : [];
+    if (matching.length !== 1) return null;
+    const saved = matching[0]!;
+    if (typeof saved.name !== "string" || saved.args === null) return null;
+    const args = saved.args;
+    const { turn, session } = snapshot;
+    const scope = and(
+      eq(schema.sessionEvents.accountId, input.accountId),
+      eq(schema.sessionEvents.workspaceId, input.workspaceId),
+      eq(schema.sessionEvents.sessionId, input.sessionId),
+      eq(schema.sessionEvents.turnId, turn.id),
+      eq(schema.sessionEvents.turnAssociation, "current"),
+      isNull(schema.sessionEvents.duplicateOfEventId),
+    );
+    const [waiting] = await tx
+      .select()
+      .from(schema.sessionEvents)
+      .where(and(scope, eq(schema.sessionEvents.type, "session.requiresAction")))
+      .orderBy(desc(schema.sessionEvents.sequence))
+      .limit(1);
+    if (!waiting?.turnAttemptId || waiting.turnGeneration === null) return null;
+    const waitPayload = object(
+      fromPostgresLosslessJson(waiting.payload, waiting.payloadCodecVersion),
+    );
+    const waitApprovals = Array.isArray(waitPayload?.approvals)
+      ? waitPayload.approvals.map(approval).filter((item) => item?.id === input.approvalId)
+      : [];
+    if (
+      waitApprovals.length !== 1 ||
+      waitApprovals[0]!.name !== saved.name ||
+      stableJson(waitApprovals[0]!.args) !== stableJson(args)
+    )
+      return null;
+
+    let toolName = saved.name;
+    let context: ToolReviewContext = { kind: "generic" };
+    // Only the immutable attempt catalog proves which fields its schema protects.
+    // Without that proof no argument value is shown and approval is unavailable.
+    let proven = false;
+    const calls = await tx
+      .select()
+      .from(schema.sessionEvents)
+      .where(
+        and(
+          scope,
+          eq(schema.sessionEvents.turnAttemptId, waiting.turnAttemptId),
+          eq(schema.sessionEvents.turnGeneration, waiting.turnGeneration),
+          eq(schema.sessionEvents.type, "agent.toolCall.created"),
+          sql`${schema.sessionEvents.payload}->>'id' = ${input.approvalId}`,
+        ),
+      )
+      .limit(2);
+    if (calls.length === 1 && calls[0]!.sequence < waiting.sequence) {
+      const call = object(
+        fromPostgresLosslessJson(calls[0]!.payload, calls[0]!.payloadCodecVersion),
+      );
+      if (
+        call?.name === saved.name &&
+        stableJson(decodeReviewArguments(call.arguments)) === stableJson(args)
+      ) {
+        const displayResult = ToolDisplayMetadata.safeParse(call.display);
+        const display = displayResult.success ? displayResult.data : undefined;
+        if (display)
+          context = {
+            kind: "generic",
+            title: (display.title ?? display.toolName.replaceAll("_", " ")).slice(0, 256),
+            ...(display.accountLabel ? { accountLabel: display.accountLabel.slice(0, 256) } : {}),
+          };
+        const [stored] = await tx
+          .select()
+          .from(schema.sessionAttemptToolCatalogs)
+          .where(
+            and(
+              eq(schema.sessionAttemptToolCatalogs.accountId, input.accountId),
+              eq(schema.sessionAttemptToolCatalogs.workspaceId, input.workspaceId),
+              eq(schema.sessionAttemptToolCatalogs.sessionId, input.sessionId),
+              eq(schema.sessionAttemptToolCatalogs.turnId, turn.id),
+              eq(schema.sessionAttemptToolCatalogs.attemptId, waiting.turnAttemptId),
+              eq(schema.sessionAttemptToolCatalogs.executionGeneration, waiting.turnGeneration),
+            ),
+          )
+          .limit(1);
+        // The immutable model-name map supplies schema privacy and exact tool
+        // identity; the accepted account binding independently supplies provider.
+        if (stored) {
+          const catalog = parseVerifiedAttemptToolCatalog(stored.catalog);
+          const entry = catalog.entries.find((item) => item.modelName === saved.name);
+          if (entry) {
+            const bindings = McpConnectionAccountBindings.safeParse(turn.mcpAccountBindings);
+            const binding = bindings.success
+              ? bindings.data.find((item) => item.serverId === entry.identity.serverId)
+              : undefined;
+            proven = true;
+            toolName = entry.identity.toolName;
+            context = toolReviewContextFromSchema(entry.inputSchema, {
+              kind:
+                entry.source === "mcp" && binding?.providerDomain === "gmailmcp.googleapis.com"
+                  ? "gmail"
+                  : "generic",
+              ...(entry.title ? { title: entry.title } : {}),
+              ...(binding?.accountLabel
+                ? { accountLabel: binding.accountLabel }
+                : context.accountLabel
+                  ? { accountLabel: context.accountLabel }
+                  : {}),
+            });
+          }
+        }
+      }
+    }
+    const [decision] = await tx
+      .select({ payload: schema.sessionEvents.payload })
+      .from(schema.sessionEvents)
+      .where(
+        and(
+          scope,
+          eq(schema.sessionEvents.type, "user.approvalDecision"),
+          gt(schema.sessionEvents.sequence, waiting.sequence),
+          sql`${schema.sessionEvents.payload}->>'approvalId' = ${input.approvalId}`,
+        ),
+      )
+      .orderBy(desc(schema.sessionEvents.sequence))
+      .limit(1);
+    const active =
+      !decision &&
+      turn.status === "requires_action" &&
+      session.status === "requires_action" &&
+      session.activeTurnId === turn.id;
+    const status = decision
+      ? object(decision.payload)?.decision === "reject"
+        ? "rejected"
+        : "approved"
+      : active
+        ? "pending"
+        : "cancelled";
+    const actionDigest = createHash("sha256")
+      .update(
+        stableJson({
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sessionId: input.sessionId,
+          turnId: turn.id,
+          approvalId: input.approvalId,
+          name: saved.name,
+          args,
+        }),
+      )
+      .digest("hex");
+    return {
+      args,
+      context,
+      proven,
+      review: ToolActionReview.parse({
+        version: 1,
+        id: input.approvalId,
+        actionDigest,
+        revision: `${snapshot.state.id}:${turn.updatedAt.toISOString()}:${status}`,
+        status,
+        ...(proven
+          ? {
+              ...toolReviewAction(toolName, args, context),
+              ...toolReviewFields(args, context),
+            }
+          : { ...toolReviewAction(toolName, null, context), fields: [], moreFields: 0 }),
+        ...(context.accountLabel ? { accountLabel: context.accountLabel } : {}),
+        reason: "This action asks first.",
+        createdAt: waiting.createdAt.toISOString(),
+        updatedAt: turn.updatedAt.toISOString(),
+        availableActions: active ? (proven ? ["approve", "reject"] : ["reject"]) : [],
+        detailsAvailable: proven,
+      }),
+    };
+  });
+}

package/src/organization-slack-bots.ts

@@ -1,6 +1,6 @@
 import { sql } from "drizzle-orm";
 import { rawRows, setSubjectRlsContext, withRlsContext, type Database } from "./database";
-import { getConnectionMetadata, listConnectionsMetadata } from "./index";
+import { getConnectionMetadata, listConnectionsMetadata } from "./connection-metadata";
 
 export type SlackBotAccess = {
   connectionId: string;

package/src/schema.ts

@@ -5293,6 +5293,7 @@ export const sessionRealtimeModes = pgTable(
     modelValid: check(
       "session_realtime_modes_model_check",
       sql`${table.model} in (
+        'opengeni-azure/gpt-live-1',
         'gpt-live-1-boulder-alpha',
         'supergrok/grok-voice-think-fast-2.0',
         'opengeni-gateway/openai/gpt-realtime-2.1',

package/src/session-realtime-billing.ts

@@ -0,0 +1,135 @@
+import { and, eq, inArray, isNotNull } from "drizzle-orm";
+
+import type { SessionRealtimeEndReason, SessionRealtimeModel } from "@opengeni/contracts";
+import { withRlsContext, withWorkspaceRls, type Database } from "./database";
+import * as schema from "./schema";
+
+/** One provider connection of a live-voice mode, bounded by server observation. */
+export type SessionRealtimeBillableConnection = {
+  id: string;
+  startedAt: Date;
+  observedUntil: Date;
+};
+
+export type SessionRealtimeBillingFacts = {
+  accountId: string;
+  workspaceId: string;
+  sessionId: string;
+  realtimeId: string;
+  model: SessionRealtimeModel;
+  ownerSubjectId: string;
+  state: "active" | "ended";
+  connections: SessionRealtimeBillableConnection[];
+};
+
+/**
+ * The last instant the server itself observed the voice owner alive. An
+ * explicit owner-proven end is observed at `endedAt`; an expired lease only up
+ * to its last heartbeat (late lazy settlement never extends the bill); an
+ * active mode up to `now`, bounded by its lease.
+ */
+export function sessionRealtimeObservedUntil(
+  mode: {
+    state: string;
+    endReason: string | null;
+    endedAt: Date | null;
+    lastHeartbeatAt: Date;
+    leaseExpiresAt: Date;
+  },
+  now: Date,
+): Date {
+  if (mode.state === "ended") {
+    const reason = mode.endReason as SessionRealtimeEndReason | null;
+    if (reason !== "lease_expired" && mode.endedAt) return mode.endedAt;
+    return mode.lastHeartbeatAt;
+  }
+  return new Date(Math.min(now.getTime(), mode.leaseExpiresAt.getTime()));
+}
+
+/**
+ * Server-observed lifetime of every provider connection that was actually
+ * issued (an SDP answer or a minted client secret was returned). Failed or
+ * never-completed negotiations issued nothing billable.
+ */
+export async function loadSessionRealtimeBillingFacts(
+  db: Database,
+  input: { workspaceId: string; sessionId: string; realtimeId: string; now?: Date },
+): Promise<SessionRealtimeBillingFacts | null> {
+  const now = input.now ?? new Date();
+  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
+    const [mode] = await scopedDb
+      .select()
+      .from(schema.sessionRealtimeModes)
+      .where(
+        and(
+          eq(schema.sessionRealtimeModes.workspaceId, input.workspaceId),
+          eq(schema.sessionRealtimeModes.sessionId, input.sessionId),
+          eq(schema.sessionRealtimeModes.id, input.realtimeId),
+        ),
+      )
+      .limit(1);
+    if (!mode) return null;
+    const observedUntil = sessionRealtimeObservedUntil(mode, now);
+    const rows = await scopedDb
+      .select({
+        id: schema.sessionRealtimeConnections.id,
+        createdAt: schema.sessionRealtimeConnections.createdAt,
+        closedAt: schema.sessionRealtimeConnections.closedAt,
+      })
+      .from(schema.sessionRealtimeConnections)
+      .where(
+        and(
+          eq(schema.sessionRealtimeConnections.realtimeId, mode.id),
+          isNotNull(schema.sessionRealtimeConnections.sdpAnswer),
+        ),
+      );
+    return {
+      accountId: mode.accountId,
+      workspaceId: mode.workspaceId,
+      sessionId: mode.sessionId,
+      realtimeId: mode.id,
+      model: mode.model as SessionRealtimeModel,
+      ownerSubjectId: mode.ownerSubjectId,
+      state: mode.state as "active" | "ended",
+      connections: rows
+        .map((row) => {
+          const closed = row.closedAt ?? observedUntil;
+          return {
+            id: row.id,
+            startedAt: row.createdAt,
+            observedUntil: new Date(
+              Math.max(
+                row.createdAt.getTime(),
+                Math.min(closed.getTime(), observedUntil.getTime()),
+              ),
+            ),
+          };
+        })
+        .sort((left, right) => left.startedAt.getTime() - right.startedAt.getTime()),
+    };
+  });
+}
+
+/** Which of these usage idempotency keys are already recorded for the account. */
+export async function existingUsageEventIdempotencyKeys(
+  db: Database,
+  input: { accountId: string; workspaceId: string; keys: readonly string[] },
+): Promise<Set<string>> {
+  if (input.keys.length === 0) return new Set();
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const rows = await scopedDb
+        .select({ key: schema.usageEvents.idempotencyKey })
+        .from(schema.usageEvents)
+        .where(
+          and(
+            eq(schema.usageEvents.accountId, input.accountId),
+            inArray(schema.usageEvents.idempotencyKey, [...input.keys]),
+          ),
+        );
+      return new Set(rows.map((row) => row.key));
+    },
+  );
+}

package/src/session-realtime-ledger.ts

@@ -1176,10 +1176,15 @@ async function admitRealtimeDelegationInTransaction(
     delegationItemId: incoming.delegationItemId!,
     ledgerEntryId: entryId,
   };
-  const inputTranscript = incoming.payload?.inputTranscript;
-  if (typeof inputTranscript !== "string" || inputTranscript.trim().length === 0) {
-    throw new Error("Realtime delegation input transcript is required");
-  }
+  // Some providers (Azure Live) delegate without echoing the user's words. The
+  // work instructions in `incoming.text` still carry the transcript delta, so a
+  // missing echo only changes the display label; it must never fail the sync
+  // batch, which the browser would retry forever.
+  const rawInputTranscript = incoming.payload?.inputTranscript;
+  const inputTranscript =
+    typeof rawInputTranscript === "string" && rawInputTranscript.trim().length > 0
+      ? rawInputTranscript
+      : "Voice request";
   const admitted = await submitHumanPromptInTransaction(db, {
     accountId,
     workspaceId: input.workspaceId,

package/src/session-realtime.ts

@@ -88,13 +88,22 @@ export type RenewSessionRealtimeInput = {
   expectedVersion: number;
   now?: Date;
   leaseMs?: number;
+  /**
+   * False keeps the current lease unchanged (owner still proven). Used when a
+   * deployment-funded call ran out of credits: the client drains and ends
+   * inside the remaining lease, and an ignoring client lapses on its own.
+   */
+  extendLease?: boolean;
 };
 
-export type EndSessionRealtimeInput = Omit<RenewSessionRealtimeInput, "leaseMs"> & {
+export type EndSessionRealtimeInput = Omit<RenewSessionRealtimeInput, "leaseMs" | "extendLease"> & {
   reason: Extract<SessionRealtimeEndReason, "user_stop" | "browser_unload">;
 };
 
-export type AssertSessionRealtimeOwnerInput = Omit<RenewSessionRealtimeInput, "leaseMs">;
+export type AssertSessionRealtimeOwnerInput = Omit<
+  RenewSessionRealtimeInput,
+  "leaseMs" | "extendLease"
+>;
 
 export type SessionRealtimeMutationResult = {
   mode: SessionRealtimeMode;
@@ -594,6 +603,15 @@ export async function renewSessionRealtimeInTransaction(
       expired: true,
     };
   }
+  if (input.extendLease === false) {
+    return {
+      mode: mapRealtimeMode(row),
+      replay: false,
+      eventIds: [],
+      workflowWakeRevision: null,
+      expired: false,
+    };
+  }
   const [renewed] = await db
     .update(schema.sessionRealtimeModes)
     .set({

package/src/tool-action-reviews.ts

@@ -1,6 +1,10 @@
 import { and, desc, eq } from "drizzle-orm";
+import { parseVerifiedAttemptToolCatalog } from "@opengeni/codemode";
 import {
+  McpConnectionAccountBindings,
   ToolActionReview,
+  toolReviewContextFromSchema,
+  type ToolReviewContext,
   toolReviewAction,
   toolReviewDetails,
   toolReviewFields,
@@ -11,6 +15,7 @@ import { type Database, withRlsContext } from "./database";
 import * as schema from "./schema";
 import { connectorActionFingerprint } from "./connector-action-fingerprint";
 import { fromPostgresLosslessJson } from "./lossless-json";
+import { legacyToolActionReview } from "./legacy-tool-action-reviews";
 
 type ReviewScope = {
   accountId: string;
@@ -65,10 +70,17 @@ async function reviewSnapshot(db: Database, input: ReviewScope) {
         .orderBy(desc(schema.agentRunStates.stateVersion))
         .limit(32);
       for (const state of states) {
-        const pending = fromPostgresLosslessJson(
-          state.pendingApprovals,
-          state.pendingApprovalsCodecVersion,
-        );
+        // Recovery is best effort: one unreadable state must not hide the
+        // decision. Unrecovered arguments leave decline as the only response.
+        let pending: unknown;
+        try {
+          pending = fromPostgresLosslessJson(
+            state.pendingApprovals,
+            state.pendingApprovalsCodecVersion,
+          );
+        } catch {
+          continue;
+        }
         if (!Array.isArray(pending)) continue;
         for (const value of pending) {
           if (!value || typeof value !== "object") continue;
@@ -86,34 +98,109 @@ async function reviewSnapshot(db: Database, input: ReviewScope) {
               continue;
             }
           }
-          if (
-            connectorActionFingerprint({ ...record.request, arguments: args }) !==
-            record.request.actionFingerprint
-          )
+          let fingerprint: string;
+          try {
+            fingerprint = connectorActionFingerprint({ ...record.request, arguments: args });
+          } catch {
             continue;
+          }
+          if (fingerprint !== record.request.actionFingerprint) continue;
           record.request.reviewArguments = JSON.stringify(args);
           break;
         }
         if (record.request.reviewArguments !== null) break;
       }
+      // Recovered bytes predate the saved review context, so the context that
+      // hides schema-protected fields must be proven from the immutable catalog of
+      // the attempt that created the request. Without that proof the arguments
+      // stay hidden and decline remains the only response.
+      if (record.request.reviewArguments !== null && record.request.reviewContext === null) {
+        const context = await catalogReviewContext(scoped, input, record);
+        if (context) record.request.reviewContext = context;
+        else record.request.reviewArguments = null;
+      }
     }
     return record;
   });
 }
 
+async function catalogReviewContext(
+  scoped: Database,
+  input: ReviewScope,
+  record: {
+    request: typeof schema.connectorActionRequests.$inferSelect;
+    turn: typeof schema.sessionTurns.$inferSelect;
+  },
+): Promise<ToolReviewContext | null> {
+  try {
+    const { request, turn } = record;
+    const [stored] = await scoped
+      .select({ catalog: schema.sessionAttemptToolCatalogs.catalog })
+      .from(schema.sessionAttemptToolCatalogs)
+      .where(
+        and(
+          eq(schema.sessionAttemptToolCatalogs.accountId, input.accountId),
+          eq(schema.sessionAttemptToolCatalogs.workspaceId, input.workspaceId),
+          eq(schema.sessionAttemptToolCatalogs.sessionId, input.sessionId),
+          eq(schema.sessionAttemptToolCatalogs.turnId, request.turnId),
+          eq(schema.sessionAttemptToolCatalogs.attemptId, request.creationAttemptId),
+          eq(
+            schema.sessionAttemptToolCatalogs.executionGeneration,
+            request.creationExecutionGeneration,
+          ),
+        ),
+      )
+      .limit(1);
+    if (!stored) return null;
+    const entries = parseVerifiedAttemptToolCatalog(stored.catalog).entries.filter(
+      (item) =>
+        item.identity.serverId === request.serverId && item.identity.toolName === request.toolName,
+    );
+    if (entries.length !== 1) return null;
+    const entry = entries[0]!;
+    const bindings = McpConnectionAccountBindings.safeParse(turn.mcpAccountBindings);
+    const binding = bindings.success
+      ? bindings.data.find((item) => item.serverId === request.serverId)
+      : undefined;
+    return toolReviewContextFromSchema(entry.inputSchema, {
+      kind:
+        entry.source === "mcp" && binding?.providerDomain === "gmailmcp.googleapis.com"
+          ? "gmail"
+          : "generic",
+      ...(entry.title ? { title: entry.title } : {}),
+      ...(binding?.accountLabel ? { accountLabel: binding.accountLabel } : {}),
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Older approvals have no saved review. Their presentation is best effort: any
+ * failure to rebuild it answers "no saved review", and clients then fall back to
+ * the approval's own arguments instead of hiding the decision.
+ */
+async function presentableLegacyReview(db: Database, input: ReviewScope) {
+  try {
+    return await legacyToolActionReview(db, input);
+  } catch {
+    return null;
+  }
+}
+
 /** The HTTP/core caller must independently authorize this session. RLS remains active here. */
 export async function getToolActionReview(
   db: Database,
   input: ReviewScope,
 ): Promise<ToolActionReview | null> {
   const record = await reviewSnapshot(db, input);
-  if (!record) return null;
+  if (!record) return (await presentableLegacyReview(db, input))?.review ?? null;
   const { request, operation, turn } = record;
   let status: ToolReviewStatus =
     request.status === "uncertain"
       ? "unknown"
       : request.status === "blocked"
-        ? "revoked"
+        ? "blocked"
         : request.status;
   if (operation?.state === "outcome_unknown") status = "unknown";
   else if (operation?.state === "cancelled")
@@ -131,8 +218,10 @@ export async function getToolActionReview(
     ["pending", "approved"].includes(status)
   )
     status = "cancelled";
-  const available =
-    status === "pending" && turn.status === "requires_action" && request.reviewArguments !== null;
+  // A person can always decline a waiting action. Approving needs the exact saved
+  // arguments; when an older request's arguments cannot be recovered, decline is
+  // the only safe decision and keeps the session from staying stuck.
+  const waiting = status === "pending" && turn.status === "requires_action";
   const args = request.reviewArguments;
   const context = request.reviewContext ?? undefined;
   const parsed = decodeReviewArguments(args);
@@ -157,14 +246,22 @@ export async function getToolActionReview(
       : {}),
     ...toolReviewFields(args, context),
     reason:
-      request.policySource === "explicit"
-        ? "Your permission setting for this action is Ask."
-        : request.policySource === "ambiguous"
-          ? "Overlapping permission settings require a review."
-          : "This action asks for approval by default.",
+      status === "blocked"
+        ? request.policySource === "explicit"
+          ? "Your permission settings block this action."
+          : request.policySource === "ambiguous"
+            ? "Two permission settings conflict, so this action is blocked."
+            : "This action is blocked by default."
+        : request.policySource === "explicit"
+          ? "This action is set to Ask first."
+          : "This action asks first by default.",
     createdAt: request.createdAt.toISOString(),
     updatedAt: (operation?.updatedAt ?? request.updatedAt).toISOString(),
-    availableActions: available ? ["approve", "reject"] : [],
+    availableActions: waiting
+      ? request.reviewArguments !== null
+        ? ["approve", "reject"]
+        : ["reject"]
+      : [],
     detailsAvailable: args !== null,
   });
 }
@@ -174,6 +271,20 @@ export async function getToolReviewDetailsPage(
   input: ReviewScope & { actionDigest: string; path: string; offset: number },
 ) {
   const record = await reviewSnapshot(db, input);
+  if (!record) {
+    const legacy = await presentableLegacyReview(db, input);
+    if (!legacy?.proven || legacy.review.actionDigest !== input.actionDigest) return null;
+    try {
+      return {
+        version: 1 as const,
+        id: input.approvalId,
+        actionDigest: input.actionDigest,
+        ...toolReviewDetails(legacy.args, legacy.context, input.path, input.offset),
+      };
+    } catch {
+      return null;
+    }
+  }
   if (
     !record ||
     record.request.actionFingerprint !== input.actionDigest ||