@opengeni/db 4.3.2 → 4.3.3-canary.1

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-XBXANJQS.js";
+} from "./chunk-M7PSMVFF.js";
 import {
   AgentCommandAuthorityError,
   CHILD_LIFECYCLE_DEDUPE_PREFIX,
@@ -108,7 +108,7 @@ import {
   updateSessionCommandReceiptResult,
   workspaceControlLockBudget,
   workspaceControlRequestLockTimeoutMs
-} from "./chunk-F4BIHJ7J.js";
+} from "./chunk-EYF6MH6C.js";
 import {
   ACTIVE_VIDEO_GENERATION_STATUSES,
   VideoGenerationCapacityError,
@@ -140,7 +140,7 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-PFBUHOI5.js";
+} from "./chunk-QLA3UQNX.js";
 import {
   ManagedAuthActorMutationInFlightError,
   ManagedAuthLoginSlotAlreadyExistsError,
@@ -163,7 +163,7 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-UUPY6IGP.js";
+} from "./chunk-UK57QA2H.js";
 import {
   migrate,
   runMigrations
@@ -190,7 +190,7 @@ import {
   inspectRuntimeDatabasePosture,
   provisionRoles,
   runtimeDatabaseReadyCheck
-} from "./chunk-YVYBAWBU.js";
+} from "./chunk-THJGMEK5.js";
 import {
   CanonicalHumanIdentityAuthorityError,
   CanonicalHumanIdentityConflictError,
@@ -204,7 +204,7 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-DVSLOUEI.js";
+} from "./chunk-2ZMTQVTR.js";
 import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   EDITABLE_ARTIFACT_KERNEL_TAIL_MAX_BYTES,
@@ -215,7 +215,7 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-UVBPOGA7.js";
+} from "./chunk-232VC2LW.js";
 import {
   SandboxProviderReadLockUnavailableError,
   SessionEventPersistenceError,
@@ -251,7 +251,7 @@ import {
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
   withWorkspaceUsageLock
-} from "./chunk-I4ITNMX2.js";
+} from "./chunk-GVZJ7XSR.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   LOSSLESS_JSON_STRING_PREFIX,
@@ -491,9 +491,17 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-AI4NC6XW.js";
+} from "./chunk-6TKL3GQO.js";
 import "./chunk-PZ5AY32C.js";
 
+// src/codex-selection-diagnostics.ts
+function codexSelectionDiagnostics(input) {
+  const transition = input.previousCredentialId === input.credentialId ? "unchanged" : input.previousCredentialId === null ? "assigned" : "switched";
+  const source = input.pinnedCredentialId === input.credentialId && input.pinSource !== "policy" ? "manual_pin" : "allocator";
+  const reason = input.reusedLease ? "lease_reused" : transition === "unchanged" ? "affinity_reused" : transition;
+  return { transition, source, reason };
+}
+
 // src/session-execution-policy.ts
 import { and, desc, eq, inArray, sql } from "drizzle-orm";
 function latestStartedSessionTurnQuery(db, workspaceId, sessionId) {
@@ -5241,7 +5249,13 @@ async function inheritChildHostMcpTurnAuthorities(db, input) {
     }
   });
 }
-async function authorizeDirectHostMcpUse(db, request) {
+async function authorizeDirectHostMcpUse(db, request, onAuthorized) {
+  const snapshot = await resolveDirectHostMcpUseAuthority(db, request);
+  if (!snapshot) return false;
+  onAuthorized?.(snapshot);
+  return true;
+}
+async function resolveDirectHostMcpUseAuthority(db, request) {
   if (!request.attemptId || !request.connectionRef.hostBinding) return false;
   const current = await getHostMcpLiveAttempt(
     db,
@@ -5321,7 +5335,7 @@ async function authorizeDirectHostMcpUse(db, request) {
       request.sessionId,
       request.attemptId
     );
-    return live !== null && live.id === request.turnId && live.executionGeneration === request.executionGeneration;
+    return live !== null && live.id === request.turnId && live.executionGeneration === request.executionGeneration && a;
   });
 }
 
@@ -9207,6 +9221,7 @@ import {
   SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND,
   parseWorkspaceArchiveDescriptor,
   parseWorkspaceArchiveObjectRef,
+  validateWorkspaceArchiveObjectRef,
   workspaceArchivePayloadPresent,
   omitInlineWorkspaceArchiveWhenObjectRefPresent,
   stableJson as stableJson16,
@@ -9265,14 +9280,41 @@ import {
 } from "@opengeni/contracts";
 import {
   environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2,
-  SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,
-  SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,
+  SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS as SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS2,
   WORKSPACE_OPENROUTER_CONNECTION_DOMAIN as WORKSPACE_OPENROUTER_CONNECTION_DOMAIN2,
   WORKSPACE_OPENROUTER_CONNECTION_ROLE,
   VERCEL_AI_GATEWAY_CONNECTION_DOMAIN as VERCEL_AI_GATEWAY_CONNECTION_DOMAIN2,
   VERCEL_AI_GATEWAY_CONNECTION_ROLE
 } from "@opengeni/config";
 
+// src/sandbox-transition-wait.ts
+import {
+  SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,
+  SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS
+} from "@opengeni/config";
+var SandboxTransitionWaitBudget = class {
+  constructor(waitMs, startedAt) {
+    this.waitMs = waitMs;
+    this.hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
+    this.currentDeadline = Math.min(this.hardDeadline, startedAt + waitMs);
+  }
+  observedCapture = false;
+  currentDeadline;
+  hardDeadline;
+  get deadline() {
+    return this.currentDeadline;
+  }
+  observeCapture(remainingMs, now) {
+    if (this.waitMs === 0 || this.observedCapture || remainingMs === null || remainingMs === void 0 || !Number.isSafeInteger(remainingMs) || remainingMs < 0 || remainingMs > SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS)
+      return;
+    this.observedCapture = true;
+    this.currentDeadline = Math.min(
+      this.hardDeadline,
+      Math.max(this.currentDeadline, now + remainingMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS)
+    );
+  }
+};
+
 // src/workspace-membership-permissions.ts
 import { Permission as PermissionSchema } from "@opengeni/contracts";
 function normalizeWorkspaceMembershipPermissions(value) {
@@ -10198,7 +10240,12 @@ import {
 // src/session-mcp-progress.ts
 import { sql as sql22 } from "drizzle-orm";
 var SESSION_MCP_PROGRESS_CHARS = 600;
-var SESSION_MCP_PROGRESS_STORAGE_CHARS = LOSSLESS_JSON_STRING_PREFIX.length + Math.ceil((SESSION_MCP_PROGRESS_CHARS + 1) * 2 / 3) * 8;
+function sessionTextStoragePrefixChars(maxChars) {
+  return LOSSLESS_JSON_STRING_PREFIX.length + Math.ceil((maxChars + 1) * 2 / 3) * 8;
+}
+var SESSION_MCP_PROGRESS_STORAGE_CHARS = sessionTextStoragePrefixChars(
+  SESSION_MCP_PROGRESS_CHARS
+);
 var SESSION_MCP_PROGRESS_UTF16_BASE64_PATTERN = "([A-Za-z0-9+/]{8})*([A-Za-z0-9+/]{8}|[A-Za-z0-9+/]{2}[AEIMQUYcgkosw048]=|[A-Za-z0-9+/]{5}[AQgw]==)";
 function sessionMcpProgressScalarIsEncodedSql(value, codecVersion) {
   return sql22`coalesce(
@@ -10209,18 +10256,27 @@ function sessionMcpProgressScalarIsEncodedSql(value, codecVersion) {
     false
   )`;
 }
-function projectSessionMcpProgressText(storedPrefix, storedChars, codecVersion, scalarIsEncoded) {
+function projectSessionTextPrefix(storedPrefix, storedChars, codecVersion, scalarIsEncoded, maxChars) {
   if (storedPrefix === null) return { text: null, originalChars: null };
   const decoded = scalarIsEncoded ? fromPostgresLosslessJson(storedPrefix, codecVersion) : storedPrefix;
   const chars = Array.from(decoded);
   const encodedPrefixWasCut = decoded !== storedPrefix && (storedChars ?? 0) > Array.from(storedPrefix).length;
   const originalChars = encodedPrefixWasCut ? null : decoded === storedPrefix ? storedChars : chars.length;
   return {
-    text: chars.slice(0, SESSION_MCP_PROGRESS_CHARS).join(""),
+    text: chars.slice(0, maxChars).join(""),
     originalChars,
     ...encodedPrefixWasCut ? { textTruncated: true } : {}
   };
 }
+function projectSessionMcpProgressText(storedPrefix, storedChars, codecVersion, scalarIsEncoded) {
+  return projectSessionTextPrefix(
+    storedPrefix,
+    storedChars,
+    codecVersion,
+    scalarIsEncoded,
+    SESSION_MCP_PROGRESS_CHARS
+  );
+}
 
 // src/new-session-drafts.ts
 import {
@@ -34154,6 +34210,7 @@ async function listInstalledPluginPackages(db, workspaceId) {
     return rows.map((row) => {
       const manifest = objectValue3(row.manifest);
       const sourceUrl = stringValue5(manifest.sourceUrl);
+      const logoUrl = stringValue5(objectValue3(manifest.discovery).logoUrl);
       const bom = pluginBom(manifest);
       if (row.status !== "active" && row.status !== "needs_attention") {
         throw new Error(`Unknown installed Plugin status: ${row.status}`);
@@ -34166,6 +34223,7 @@ async function listInstalledPluginPackages(db, workspaceId) {
         category: row.category,
         tags: stringArray3(manifest.tags).length > 0 ? stringArray3(manifest.tags) : stringArray3(row.tags),
         sourceUrl: sourceUrl && safeHttpUrl(sourceUrl) ? sourceUrl : null,
+        logoUrl: logoUrl && safeHttpUrl(logoUrl) ? logoUrl : null,
         manifestDigest: row.manifestDigest,
         installationVersion: row.installationVersion,
         componentCount: bom.length,
@@ -40514,7 +40572,7 @@ async function prepareComputerSessionCreate(db, input) {
         requestDigest: digest2,
         state: "prepared",
         actorSubjectId: input.actorSubjectId
-      }).onConflictDoNothing({ target: interactionOperations.operationId }).returning();
+      }).onConflictDoNothing().returning();
       if (!insertedOperation) {
         const existing = await loadOperation3(tx, input.workspaceId, input.operationId);
         if (!existing) {
@@ -61541,6 +61599,86 @@ async function setSessionCodexPin(db, workspaceId, sessionId, pinnedCredentialId
     )
   );
 }
+async function recordSessionCodexSelectionForTurnAttempt(db, input) {
+  return await withWorkspaceSessionEventActivityRls(db, input.workspaceId, true, async (tx) => {
+    const fence = await lockTurnAttemptWriteFenceTx(tx, {
+      workspaceId: input.workspaceId,
+      sessionId: input.sessionId,
+      turnId: input.turnId,
+      executionGeneration: input.executionGeneration,
+      attemptId: input.attemptId,
+      sessionLock: "no_key_update"
+    });
+    if (!fence.allowed || !fence.session) throw new CodexCredentialLeaseAttemptFencedError();
+    const key2 = `opengeni:codex-selection:${input.attemptId}`;
+    const prior = await tx.select().from(sessionEvents).where(
+      and56(
+        eq57(sessionEvents.workspaceId, input.workspaceId),
+        eq57(sessionEvents.sessionId, input.sessionId),
+        inArray31(sessionEvents.clientEventId, [key2, `${key2}:switch`])
+      )
+    ).orderBy(asc22(sessionEvents.sequence));
+    if (prior.length) {
+      const receipt2 = prior.find((event) => event.type === "codex.credential.selected");
+      if (!receipt2) throw new Error("Codex selection receipt missing");
+      const payload = sessionEventPayloadRecord(receipt2.payload, receipt2.payloadCodecVersion);
+      if (payload.credentialId !== input.credentialId)
+        throw new Error("An attempt cannot record two different Codex selections");
+      return {
+        events: prior.map(mapEvent2),
+        diagnostics: {
+          transition: payload.transition,
+          source: payload.source,
+          reason: payload.reason
+        }
+      };
+    }
+    const previousCredentialId = fence.session.codexLastCredentialId;
+    const diagnostics = codexSelectionDiagnostics({ ...input, previousCredentialId });
+    const events = [];
+    if (previousCredentialId !== null && previousCredentialId !== input.credentialId) {
+      events.push({
+        type: "codex.account.switched",
+        clientEventId: `${key2}:switch`,
+        payload: {
+          fromAccountId: previousCredentialId,
+          toAccountId: input.credentialId,
+          reason: diagnostics.source === "manual_pin" ? "manual" : "rotation"
+        }
+      });
+    }
+    events.push({
+      type: "codex.credential.selected",
+      clientEventId: key2,
+      payload: {
+        credentialId: input.credentialId,
+        strategy: input.strategy,
+        ...diagnostics,
+        previousCredentialId,
+        eligibleCount: input.eligibleCount,
+        connectedCount: input.connectedCount,
+        reused: input.reusedLease
+      }
+    });
+    await tx.update(sessions).set({ codexLastCredentialId: input.credentialId }).where(
+      and56(
+        eq57(sessions.workspaceId, input.workspaceId),
+        eq57(sessions.id, input.sessionId)
+      )
+    );
+    const appended = await appendSessionEventsForTurnAttempt(
+      tx,
+      input.workspaceId,
+      input.sessionId,
+      input.turnId,
+      input.executionGeneration,
+      input.attemptId,
+      events
+    );
+    if (!appended.accepted) throw new CodexCredentialLeaseAttemptFencedError();
+    return { events: appended.events, diagnostics };
+  });
+}
 async function recordSessionActiveCodexCredential(db, workspaceId, sessionId, credentialId) {
   await withWorkspaceSessionActivityRls(db, workspaceId, async (scopedDb) => {
     await scopedDb.update(sessions).set({ codexLastCredentialId: credentialId }).where(
@@ -64983,9 +65121,95 @@ async function listSessionsForSubject(db, workspaceId, options) {
   }
   throw new Error("unreachable session list retry state");
 }
+async function sessionFailureDiagnostics(db, workspaceId, session) {
+  if (session.status !== "failed") return null;
+  const scope = and56(
+    eq57(sessionEvents.workspaceId, workspaceId),
+    eq57(sessionEvents.sessionId, session.id),
+    lte4(sessionEvents.sequence, session.lastSequence),
+    isNull16(sessionEvents.duplicateOfEventId),
+    or12(
+      isNull16(sessionEvents.turnAssociation),
+      eq57(sessionEvents.turnAssociation, "current")
+    )
+  );
+  const maxChars = 1024;
+  const storageChars = sessionTextStoragePrefixChars(maxChars);
+  const diagnosticFields = ["error", "message", "detail", "lastRetryableError", "code", "status"];
+  const boundedFields = diagnosticFields.flatMap((field) => {
+    const scalar = sql81`case when jsonb_typeof(${sessionEvents.payload}->${field}::text) = 'string'
+      then ${sessionEvents.payload}->>${field}::text else null end`;
+    return [
+      sql81`${field}::text`,
+      sql81`jsonb_build_object(
+      'prefix', left(${scalar}, ${storageChars}), 'chars', char_length(${scalar}),
+      'encoded', ${sessionMcpProgressScalarIsEncodedSql(scalar, sessionEvents.payloadCodecVersion)})`
+    ];
+  });
+  const projectedPayload = sql81`jsonb_build_object(
+    ${sql81.join(boundedFields, sql81`, `)},
+    'providerRecoveryCount', case when jsonb_typeof(${sessionEvents.payload}->'providerRecoveryCount') = 'number'
+      and length((${sessionEvents.payload}->'providerRecoveryCount')::text) <= 16
+      then ${sessionEvents.payload}->'providerRecoveryCount' else 'null'::jsonb end)`;
+  const latest = async (type) => {
+    const [row] = await db.select({
+      id: sessionEvents.id,
+      sequence: sessionEvents.sequence,
+      turnId: sessionEvents.turnId,
+      occurredAt: sessionEvents.occurredAt,
+      codecVersion: sessionEvents.payloadCodecVersion,
+      payload: projectedPayload
+    }).from(sessionEvents).where(and56(scope, eq57(sessionEvents.type, type))).orderBy(desc22(sessionEvents.sequence)).limit(1);
+    if (!row) return null;
+    const payload = {
+      providerRecoveryCount: row.payload.providerRecoveryCount
+    };
+    const truncatedFields = [];
+    for (const field of diagnosticFields) {
+      const stored = row.payload[field];
+      const projected = projectSessionTextPrefix(
+        stored.prefix,
+        stored.chars,
+        row.codecVersion,
+        stored.encoded,
+        maxChars
+      );
+      payload[field] = projected.text;
+      if (projected.textTruncated || (projected.originalChars ?? 0) > maxChars)
+        truncatedFields.push(field);
+    }
+    payload.projection = { fieldsOnly: true, fieldLimitChars: maxChars, truncatedFields };
+    return { ...row, payload, occurredAt: row.occurredAt.toISOString() };
+  };
+  const turnFailure = await latest("turn.failed");
+  const latestStatus = await latest("session.status.changed");
+  const statusPayload = latestStatus?.payload;
+  if (latestStatus && (!turnFailure || latestStatus.sequence > turnFailure.sequence) && typeof statusPayload?.status === "string" && statusPayload.status !== "failed")
+    return null;
+  const preClaimFailure = statusPayload?.status === "failed" && statusPayload.code === "pre_claim_failure" ? latestStatus : null;
+  const failure = preClaimFailure && (!turnFailure || preClaimFailure.sequence > turnFailure.sequence && (!preClaimFailure.turnId || preClaimFailure.turnId !== turnFailure.turnId)) ? preClaimFailure : turnFailure;
+  if (!failure) return null;
+  return {
+    eventId: failure.id,
+    sequence: failure.sequence,
+    turnId: failure.turnId ?? null,
+    occurredAt: failure.occurredAt,
+    payload: failure.payload
+  };
+}
 async function getSessionForSubject(db, workspaceId, sessionId, subjectId, relatedSessionAccess = "root") {
   return await withWorkspaceSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
-    const [row] = await scopedDb.select({ session: sessions, pin: sessionPins }).from(sessions).leftJoin(
+    const [row] = await scopedDb.select({
+      session: sessions,
+      pin: sessionPins,
+      cursor: sessionEventCursors
+    }).from(sessions).leftJoin(
+      sessionEventCursors,
+      and56(
+        eq57(sessionEventCursors.workspaceId, sessions.workspaceId),
+        eq57(sessionEventCursors.sessionId, sessions.id)
+      )
+    ).leftJoin(
       sessionPins,
       and56(
         eq57(sessionPins.workspaceId, workspaceId),
@@ -65007,25 +65231,36 @@ async function getSessionForSubject(db, workspaceId, sessionId, subjectId, relat
       )
     ).limit(1);
     if (!row) return null;
-    const [session] = await canonicalSessionRowsFromEventCursors(scopedDb, workspaceId, [
-      row.session
-    ]);
+    if (!row.cursor || row.cursor.accountId !== row.session.accountId || row.cursor.lastSequence < row.session.lastSequence) {
+      throw new Error(`Session event cursor invariant failed for session ${sessionId}`);
+    }
+    const [session] = await withLatestStartedSessionPolicy(
+      scopedDb,
+      workspaceId,
+      await withCurrentSessionInputWait(scopedDb, workspaceId, [
+        { ...row.session, lastSequence: row.cursor.lastSequence }
+      ])
+    );
     if (!session) throw new Error(`Session event cursor missing for session ${sessionId}`);
     const mcpServers = await sessionMcpServerMetadataForSessions(scopedDb, workspaceId, [
       sessionId
     ]);
     const tenancyActivated = await sessionTenancyProductActivated(scopedDb, workspaceId);
+    const failureDiagnostics = await sessionFailureDiagnostics(scopedDb, workspaceId, session);
     return projectSessionForRelatedAccess(
-      await mapSessionWithControl(
-        scopedDb,
-        session,
-        mcpServers.get(sessionId) ?? [],
-        mapSessionPin(row.pin),
-        mapSessionAttention(session, row.pin),
-        mapSessionArchive(row.pin),
-        void 0,
-        { subjectId, activated: tenancyActivated }
-      ),
+      {
+        ...await mapSessionWithControl(
+          scopedDb,
+          session,
+          mcpServers.get(sessionId) ?? [],
+          mapSessionPin(row.pin),
+          mapSessionAttention(session, row.pin),
+          mapSessionArchive(row.pin),
+          void 0,
+          { subjectId, activated: tenancyActivated }
+        ),
+        failureDiagnostics
+      },
       relatedSessionAccess
     );
   });
@@ -69862,14 +70097,7 @@ function archiveCaptureRemainingMs(row) {
     return null;
   }
   const remainingMs = Number(row.archive_capture_remaining_ms);
-  return Number.isSafeInteger(remainingMs) && remainingMs >= 0 && remainingMs <= SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS ? remainingMs : null;
-}
-function extendSandboxTransitionDeadline(currentDeadline, hardDeadline, remainingCaptureMs, now) {
-  if (remainingCaptureMs === null || remainingCaptureMs === void 0) return currentDeadline;
-  return Math.min(
-    hardDeadline,
-    Math.max(currentDeadline, now + remainingCaptureMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS)
-  );
+  return Number.isSafeInteger(remainingMs) && remainingMs >= 0 && remainingMs <= SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS2 ? remainingMs : null;
 }
 function providerlessLeaseBackendPredicateSql() {
   const providerlessBackends = Object.entries(SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND).filter(([, fields]) => fields.length === 0).map(([backend]) => backend);
@@ -70345,25 +70573,19 @@ async function acquireLease(db, input) {
     throw new Error("Sandbox lease archive capture wait is invalid");
   }
   const startedAt = performance.now();
-  const hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
-  let deadline = Math.min(hardDeadline, startedAt + captureWaitMs);
+  const waitBudget = new SandboxTransitionWaitBudget(captureWaitMs, startedAt);
   let delayMs = 25;
   for (; ; ) {
     const result = await acquireLeaseOnce(db, input);
     const now = performance.now();
     if (captureWaitMs > 0 && result.role === "fenced" && result.reason === "capture_in_progress") {
-      deadline = extendSandboxTransitionDeadline(
-        deadline,
-        hardDeadline,
-        result.captureRemainingMs,
-        now
-      );
+      waitBudget.observeCapture(result.captureRemainingMs, now);
     }
-    if (result.role !== "fenced" || result.reason === "superseded" || result.reason === "rotation_in_progress" || now >= deadline) {
+    if (result.role !== "fenced" || result.reason === "superseded" || result.reason === "rotation_in_progress" || now >= waitBudget.deadline) {
       return result;
     }
     await waitForSandboxTransition(
-      Math.min(delayMs, Math.max(1, deadline - now)),
+      Math.min(delayMs, Math.max(1, waitBudget.deadline - now)),
       input.waitSignal,
       "Sandbox lease transition wait cancelled"
     );
@@ -74139,8 +74361,7 @@ async function advanceWorkspaceGenerationForAuthority(db, authority, operationIn
     throw new Error("Workspace archive capture wait is invalid");
   }
   const startedAt = performance.now();
-  const hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
-  let deadline = Math.min(hardDeadline, startedAt + captureWaitMs);
+  const waitBudget = new SandboxTransitionWaitBudget(captureWaitMs, startedAt);
   let delayMs = 25;
   let captureWaitStartedAt;
   let captureWaitOutcome = "failed";
@@ -74157,19 +74378,14 @@ async function advanceWorkspaceGenerationForAuthority(db, authority, operationIn
       } catch (error) {
         const now = performance.now();
         if (captureWaitMs > 0 && error instanceof SandboxWorkspaceMutationFencedError && error.code === "capture_in_progress") {
-          deadline = extendSandboxTransitionDeadline(
-            deadline,
-            hardDeadline,
-            error.captureRemainingMs,
-            now
-          );
+          waitBudget.observeCapture(error.captureRemainingMs, now);
         }
-        if (!(error instanceof SandboxWorkspaceMutationFencedError) || error.code !== "capture_in_progress" || now >= deadline) {
+        if (!(error instanceof SandboxWorkspaceMutationFencedError) || error.code !== "capture_in_progress" || now >= waitBudget.deadline) {
           throw error;
         }
         captureWaitStartedAt ??= performance.now();
         await waitForSandboxTransition(
-          Math.min(delayMs, Math.max(1, deadline - now)),
+          Math.min(delayMs, Math.max(1, waitBudget.deadline - now)),
           waitSignal,
           "Sandbox workspace mutation wait cancelled"
         );
@@ -75415,7 +75631,7 @@ async function claimWorkspaceArchiveCapture(db, input) {
     throw new Error("Workspace archive capture timeout is invalid");
   }
   const operationId = input.operationId ?? input.captureId;
-  const providerRequestId = operationId;
+  const providerRequestId = randomUUID12();
   const captureAttempt = input.attempt ?? 1;
   const providerReplaySafe = input.providerReplaySafe === true;
   const takeoverSafe = input.takeoverSafe === true;
@@ -76187,7 +76403,17 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
   );
 }
 function publishedWorkspaceArchiveFields(input) {
-  const ref = parseWorkspaceArchiveObjectRef(input.workspaceArchiveRef) ?? void 0;
+  const ref = input.workspaceArchiveRef == null ? void 0 : validateWorkspaceArchiveObjectRef(input.workspaceArchiveRef, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    sandboxGroupId: input.sandboxGroupId,
+    descriptor: input.workspaceArchiveMeta
+  }) ?? void 0;
+  if (input.workspaceArchiveRef != null && !ref) {
+    throw new Error(
+      "Invalid workspace archive object ref: publication scope or descriptor mismatch"
+    );
+  }
   const inline = typeof input.workspaceArchive === "string" && input.workspaceArchive.length > 0 ? input.workspaceArchive : void 0;
   if (!ref && !inline) {
     throw new Error("workspace archive publication requires inline bytes or an object ref");
@@ -76204,11 +76430,24 @@ function publishedWorkspaceArchiveFields(input) {
   }
   return { workspaceArchive: inline };
 }
+function workspaceArchiveCandidateFields(candidate, lockedResumeState) {
+  if (!candidate) return {};
+  const sessionState = lockedResumeState?.sessionState;
+  const referenced = [
+    sessionState?.workspaceArchiveRef,
+    sessionState?.workspaceArchivePrevRef
+  ].some((value) => {
+    const ref = parseWorkspaceArchiveObjectRef(value);
+    return ref?.key === candidate.key && ref.backend === candidate.backend;
+  });
+  return { candidateDisposition: referenced ? "already_referenced" : "unused" };
+}
 async function persistDrainSnapshot(db, input) {
   const workspaceArchiveMeta = input.workspaceArchive === null ? null : parseArchiveRevision(input.workspaceArchiveMeta);
   if (input.workspaceArchive !== null && !workspaceArchiveMeta) {
     throw new Error("Invalid verified workspace archive descriptor");
   }
+  const published = input.workspaceArchive === null ? null : publishedWorkspaceArchiveFields(input);
   if (workspaceArchiveMeta?.version === 2 && (workspaceArchiveMeta.provider === "modal_snapshot_filesystem" || workspaceArchiveMeta.provider === "modal_snapshot_directory") && !input.checkpointArtifactId) {
     throw new Error("Modal native checkpoint publication requires a registered artifact");
   }
@@ -76246,10 +76485,15 @@ async function persistDrainSnapshot(db, input) {
         for update
       `);
       const row = guard[0];
+      const candidateFields = workspaceArchiveCandidateFields(
+        published?.workspaceArchiveRef,
+        row?.resume_state
+      );
       if (!row) {
         return {
           wrote: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const sourceLeaseMatches = input.expectedLeaseId === void 0 || row.id === input.expectedLeaseId;
@@ -76259,7 +76503,7 @@ async function persistDrainSnapshot(db, input) {
       const lateReceipt = recovery.lateArchiveCapture;
       const coldLatePublication = input.workspaceArchive !== null && input.expectedLeaseId !== void 0 && input.providerRequestId !== void 0 && row.id === input.expectedLeaseId && row.liveness === "cold" && Number(row.refcount) === 0 && Number(row.lease_epoch) === input.expectedEpoch + 1 && row.instance_id === null && Number(row.workspace_generation) === input.expectedWorkspaceGeneration && row.archive_capture_id === null && recovery.provider.status === "missing" && recovery.provider.instanceId === input.expectedInstanceId && recovery.restore.rematerializationId === null && (recovery.restore.status === "unrecoverable" || recovery.restore.status === "degraded" || recovery.restore.status === "pending") && lateReceipt?.sourceLeaseId === input.expectedLeaseId && lateReceipt.sourceLeaseEpoch === input.expectedEpoch && lateReceipt.sourceInstanceId === input.expectedInstanceId && lateReceipt.sourceWorkspaceGeneration === input.expectedWorkspaceGeneration && lateReceipt.providerRequestId === input.providerRequestId && !row.unsettled_mutation;
       if (!activePublication && !coldLatePublication) {
-        return { wrote: false, archiveRevision: null };
+        return { wrote: false, archiveRevision: null, ...candidateFields };
       }
       const priorArchive = row.prior_archive ?? null;
       const priorArchivePrev = row.prior_archive_prev ?? null;
@@ -76271,7 +76515,7 @@ async function persistDrainSnapshot(db, input) {
           archiveRevision: null
         };
       }
-      const published = publishedWorkspaceArchiveFields(input);
+      if (!published) throw new Error("Missing workspace archive publication fields");
       const priorMeta = parseArchiveRevision(priorSessionState?.workspaceArchiveMeta);
       if (activePublication && row.archive_capture_published_at !== null) {
         if (priorArchive === null && priorRef === null || priorMeta === null) {
@@ -76291,7 +76535,7 @@ async function persistDrainSnapshot(db, input) {
               )
           `);
         }
-        return { wrote: true, archiveRevision: priorMeta.revision };
+        return { wrote: true, archiveRevision: priorMeta.revision, ...candidateFields };
       }
       const rotation = rotateWorkspaceArchives({
         resumeState: row.resume_state,
@@ -76345,12 +76589,14 @@ async function persistDrainSnapshot(db, input) {
       if (!folded) {
         return {
           wrote: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       return {
         wrote: true,
-        archiveRevision: workspaceArchiveMeta?.revision ?? null
+        archiveRevision: workspaceArchiveMeta?.revision ?? null,
+        ...published.workspaceArchiveRef ? { candidateDisposition: "adopted" } : {}
       };
     }
   );
@@ -76627,12 +76873,27 @@ async function persistWarmSnapshot(db, input) {
         )
       ).limit(1) : [];
       const attemptMayPersistWorkspace = attempt !== void 0 && (attempt.state === "claimed" || attempt.state === "running" ? attempt.outcome === null : attempt.state === "closed" && (attempt.outcome === "completed" || attempt.outcome === "failed" || attempt.outcome === "requires_action"));
+      const candidateLease = published.workspaceArchiveRef ? await scopedDb.execute(sql81`
+            select jsonb_build_object('sessionState', jsonb_build_object(
+              'workspaceArchiveRef', resume_state #> '{sessionState,workspaceArchiveRef}',
+              'workspaceArchivePrevRef', resume_state #> '{sessionState,workspaceArchivePrevRef}'
+            )) as resume_state
+            from sandbox_leases
+            where workspace_id = ${input.workspaceId}
+              and sandbox_group_id = ${input.sandboxGroupId}
+            for update
+          `) : [];
+      const candidateFields = workspaceArchiveCandidateFields(
+        published.workspaceArchiveRef,
+        candidateLease[0]?.resume_state
+      );
       if (!attempt || attempt.accountId !== input.accountId || attempt.sandboxGroupId !== input.sandboxGroupId || interruption || !attemptMayPersistWorkspace) {
         return {
           wrote: false,
           throttled: false,
           superseded: true,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const guard = await scopedDb.execute(sql81`
@@ -76680,7 +76941,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const priorArchive = guard[0].prior_archive ?? null;
@@ -76693,7 +76955,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: true,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       if (input.minIntervalMs > 0 && Number.isFinite(priorAtMs) && capturedAtMs - priorAtMs < input.minIntervalMs) {
@@ -76701,7 +76964,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: true,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const rotation = rotateWorkspaceArchives({
@@ -76722,7 +76986,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const livenessGuard = rowLiveness;
@@ -76752,14 +77017,16 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       return {
         wrote: true,
         throttled: false,
         superseded: false,
-        archiveRevision: workspaceArchiveMeta.revision
+        archiveRevision: workspaceArchiveMeta.revision,
+        ...published.workspaceArchiveRef ? { candidateDisposition: "adopted" } : {}
       };
     }
   );
@@ -82822,7 +83089,8 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
     {
       stage: "session_attempts.claim",
       eventTypes: ["session.turn.attempt_claimed"],
-      maxAttempts: 3
+      maxAttempts: 3,
+      organizationMembershipFence: true
     },
     async (scopedDb) => await withSessionActivitySavepoint(scopedDb, async (tx) => {
       const deliverPendingUpdates = async (accountId, turnId, turnGeneration, nextSequence, occurredAt, triggerEventId, expectedXaiAuthority, options = {}) => {
@@ -93264,6 +93532,7 @@ export {
   closeSessionTurnAttemptInTransaction,
   closeSlackInteractionDelivery,
   codexCapacityRefreshBackoffMs,
+  codexSelectionDiagnostics,
   commitBrowserRevisionPublication,
   commitBrowserSessionSuspension,
   commitBrowserStateUploadInTransaction,
@@ -94234,6 +94503,7 @@ export {
   recordRetainedProcessReconciliationProof,
   recordRetainedScreenshotArtifactError,
   recordSessionActiveCodexCredential,
+  recordSessionCodexSelectionForTurnAttempt,
   recordSessionGoalProgressWithEvent,
   recordSkippedContextCompaction,
   recordSlackBotInstallCallbackFailure,