@opengeni/db 4.3.3-canary.0 → 4.3.3-canary.2

package/dist/codex-selection-diagnostics.d.ts

@@ -0,0 +1,12 @@
+/** Observations about this session, never allocator inputs or failover policy. */
+export declare function codexSelectionDiagnostics(input: {
+    previousCredentialId: string | null;
+    credentialId: string;
+    reusedLease: boolean;
+    pinnedCredentialId: string | null;
+    pinSource?: "manual" | "policy" | null;
+}): {
+    transition: "assigned" | "switched" | "unchanged";
+    source: "allocator" | "manual_pin";
+    reason: "affinity_reused" | "assigned" | "lease_reused" | "switched";
+};

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { codexSelectionDiagnostics } from "./codex-selection-diagnostics.js";
+export { codexSelectionDiagnostics } from "./codex-selection-diagnostics.js";
 import { type ModelConnectionAccess, type ModelConnectionTarget } from "./model-connection-access.js";
 export { assertModelConnectionAllowsTurn, modelAllowedByConnections, type ConnectionModelRestrictions, } from "./workspace-model-connection-access.js";
 export * from "./model-connection-access.js";
@@ -4884,6 +4886,27 @@ export declare function switchSessionCodexAccount(db: Database, input: {
 }>>;
 export declare function setSessionCodexPin(db: Database, workspaceId: string, sessionId: string, pinnedCredentialId: string | null, source?: CodexPinSource, options?: SetSessionCodexPinOptions): Promise<boolean>;
 /** Written by the worker at the turn boundary; drives the in-session indicator. */
+/** Commit observed assignment and its events together under the exact live attempt.
+ * Allocation still uses its frozen policy snapshot; this is observation only.
+ * Replays return the same receipt and never manufacture a second switch.
+ */
+export declare function recordSessionCodexSelectionForTurnAttempt(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    credentialId: string;
+    strategy: string;
+    reusedLease: boolean;
+    pinnedCredentialId: string | null;
+    pinSource: "manual" | "policy" | null;
+    eligibleCount: number;
+    connectedCount: number;
+}): Promise<{
+    events: SessionEvent[];
+    diagnostics: ReturnType<typeof codexSelectionDiagnostics>;
+}>;
 export declare function recordSessionActiveCodexCredential(db: Database, workspaceId: string, sessionId: string, credentialId: string): Promise<void>;
 /**
  * Disconnect ONE account. DELETE WHERE id = credentialId AND workspace_id. If it
@@ -5471,7 +5494,6 @@ export declare function reapExpiredSessionListSnapshots(db: Database, limit?: nu
  * lifecycle/title and authorization data.
  */
 export declare function listSessionsForSubject(db: Database, workspaceId: string, options: ListSessionsForSubjectOptions): Promise<SessionListResponse>;
-/** Read a session with the caller subject's personal pin projection. */
 export declare function getSessionForSubject(db: Database, workspaceId: string, sessionId: string, subjectId: string, relatedSessionAccess?: "target" | "root"): Promise<Session | null>;
 /**
  * Idempotently set a member's pin without mutating the session's lifecycle or

package/dist/index.js

@@ -494,6 +494,14 @@ import {
 } from "./chunk-6TKL3GQO.js";
 import "./chunk-PZ5AY32C.js";
 
+// src/codex-selection-diagnostics.ts
+function codexSelectionDiagnostics(input) {
+  const transition = input.previousCredentialId === input.credentialId ? "unchanged" : input.previousCredentialId === null ? "assigned" : "switched";
+  const source = input.pinnedCredentialId === input.credentialId && input.pinSource !== "policy" ? "manual_pin" : "allocator";
+  const reason = input.reusedLease ? "lease_reused" : transition === "unchanged" ? "affinity_reused" : transition;
+  return { transition, source, reason };
+}
+
 // src/session-execution-policy.ts
 import { and, desc, eq, inArray, sql } from "drizzle-orm";
 function latestStartedSessionTurnQuery(db, workspaceId, sessionId) {
@@ -9272,14 +9280,41 @@ import {
 } from "@opengeni/contracts";
 import {
   environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2,
-  SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,
-  SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,
+  SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS as SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS2,
   WORKSPACE_OPENROUTER_CONNECTION_DOMAIN as WORKSPACE_OPENROUTER_CONNECTION_DOMAIN2,
   WORKSPACE_OPENROUTER_CONNECTION_ROLE,
   VERCEL_AI_GATEWAY_CONNECTION_DOMAIN as VERCEL_AI_GATEWAY_CONNECTION_DOMAIN2,
   VERCEL_AI_GATEWAY_CONNECTION_ROLE
 } from "@opengeni/config";
 
+// src/sandbox-transition-wait.ts
+import {
+  SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,
+  SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS
+} from "@opengeni/config";
+var SandboxTransitionWaitBudget = class {
+  constructor(waitMs, startedAt) {
+    this.waitMs = waitMs;
+    this.hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
+    this.currentDeadline = Math.min(this.hardDeadline, startedAt + waitMs);
+  }
+  observedCapture = false;
+  currentDeadline;
+  hardDeadline;
+  get deadline() {
+    return this.currentDeadline;
+  }
+  observeCapture(remainingMs, now) {
+    if (this.waitMs === 0 || this.observedCapture || remainingMs === null || remainingMs === void 0 || !Number.isSafeInteger(remainingMs) || remainingMs < 0 || remainingMs > SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS)
+      return;
+    this.observedCapture = true;
+    this.currentDeadline = Math.min(
+      this.hardDeadline,
+      Math.max(this.currentDeadline, now + remainingMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS)
+    );
+  }
+};
+
 // src/workspace-membership-permissions.ts
 import { Permission as PermissionSchema } from "@opengeni/contracts";
 function normalizeWorkspaceMembershipPermissions(value) {
@@ -10205,7 +10240,12 @@ import {
 // src/session-mcp-progress.ts
 import { sql as sql22 } from "drizzle-orm";
 var SESSION_MCP_PROGRESS_CHARS = 600;
-var SESSION_MCP_PROGRESS_STORAGE_CHARS = LOSSLESS_JSON_STRING_PREFIX.length + Math.ceil((SESSION_MCP_PROGRESS_CHARS + 1) * 2 / 3) * 8;
+function sessionTextStoragePrefixChars(maxChars) {
+  return LOSSLESS_JSON_STRING_PREFIX.length + Math.ceil((maxChars + 1) * 2 / 3) * 8;
+}
+var SESSION_MCP_PROGRESS_STORAGE_CHARS = sessionTextStoragePrefixChars(
+  SESSION_MCP_PROGRESS_CHARS
+);
 var SESSION_MCP_PROGRESS_UTF16_BASE64_PATTERN = "([A-Za-z0-9+/]{8})*([A-Za-z0-9+/]{8}|[A-Za-z0-9+/]{2}[AEIMQUYcgkosw048]=|[A-Za-z0-9+/]{5}[AQgw]==)";
 function sessionMcpProgressScalarIsEncodedSql(value, codecVersion) {
   return sql22`coalesce(
@@ -10216,18 +10256,27 @@ function sessionMcpProgressScalarIsEncodedSql(value, codecVersion) {
     false
   )`;
 }
-function projectSessionMcpProgressText(storedPrefix, storedChars, codecVersion, scalarIsEncoded) {
+function projectSessionTextPrefix(storedPrefix, storedChars, codecVersion, scalarIsEncoded, maxChars) {
   if (storedPrefix === null) return { text: null, originalChars: null };
   const decoded = scalarIsEncoded ? fromPostgresLosslessJson(storedPrefix, codecVersion) : storedPrefix;
   const chars = Array.from(decoded);
   const encodedPrefixWasCut = decoded !== storedPrefix && (storedChars ?? 0) > Array.from(storedPrefix).length;
   const originalChars = encodedPrefixWasCut ? null : decoded === storedPrefix ? storedChars : chars.length;
   return {
-    text: chars.slice(0, SESSION_MCP_PROGRESS_CHARS).join(""),
+    text: chars.slice(0, maxChars).join(""),
     originalChars,
     ...encodedPrefixWasCut ? { textTruncated: true } : {}
   };
 }
+function projectSessionMcpProgressText(storedPrefix, storedChars, codecVersion, scalarIsEncoded) {
+  return projectSessionTextPrefix(
+    storedPrefix,
+    storedChars,
+    codecVersion,
+    scalarIsEncoded,
+    SESSION_MCP_PROGRESS_CHARS
+  );
+}
 
 // src/new-session-drafts.ts
 import {
@@ -34161,6 +34210,7 @@ async function listInstalledPluginPackages(db, workspaceId) {
     return rows.map((row) => {
       const manifest = objectValue3(row.manifest);
       const sourceUrl = stringValue5(manifest.sourceUrl);
+      const logoUrl = stringValue5(objectValue3(manifest.discovery).logoUrl);
       const bom = pluginBom(manifest);
       if (row.status !== "active" && row.status !== "needs_attention") {
         throw new Error(`Unknown installed Plugin status: ${row.status}`);
@@ -34173,6 +34223,7 @@ async function listInstalledPluginPackages(db, workspaceId) {
         category: row.category,
         tags: stringArray3(manifest.tags).length > 0 ? stringArray3(manifest.tags) : stringArray3(row.tags),
         sourceUrl: sourceUrl && safeHttpUrl(sourceUrl) ? sourceUrl : null,
+        logoUrl: logoUrl && safeHttpUrl(logoUrl) ? logoUrl : null,
         manifestDigest: row.manifestDigest,
         installationVersion: row.installationVersion,
         componentCount: bom.length,
@@ -40521,7 +40572,7 @@ async function prepareComputerSessionCreate(db, input) {
         requestDigest: digest2,
         state: "prepared",
         actorSubjectId: input.actorSubjectId
-      }).onConflictDoNothing({ target: interactionOperations.operationId }).returning();
+      }).onConflictDoNothing().returning();
       if (!insertedOperation) {
         const existing = await loadOperation3(tx, input.workspaceId, input.operationId);
         if (!existing) {
@@ -61548,6 +61599,86 @@ async function setSessionCodexPin(db, workspaceId, sessionId, pinnedCredentialId
     )
   );
 }
+async function recordSessionCodexSelectionForTurnAttempt(db, input) {
+  return await withWorkspaceSessionEventActivityRls(db, input.workspaceId, true, async (tx) => {
+    const fence = await lockTurnAttemptWriteFenceTx(tx, {
+      workspaceId: input.workspaceId,
+      sessionId: input.sessionId,
+      turnId: input.turnId,
+      executionGeneration: input.executionGeneration,
+      attemptId: input.attemptId,
+      sessionLock: "no_key_update"
+    });
+    if (!fence.allowed || !fence.session) throw new CodexCredentialLeaseAttemptFencedError();
+    const key2 = `opengeni:codex-selection:${input.attemptId}`;
+    const prior = await tx.select().from(sessionEvents).where(
+      and56(
+        eq57(sessionEvents.workspaceId, input.workspaceId),
+        eq57(sessionEvents.sessionId, input.sessionId),
+        inArray31(sessionEvents.clientEventId, [key2, `${key2}:switch`])
+      )
+    ).orderBy(asc22(sessionEvents.sequence));
+    if (prior.length) {
+      const receipt2 = prior.find((event) => event.type === "codex.credential.selected");
+      if (!receipt2) throw new Error("Codex selection receipt missing");
+      const payload = sessionEventPayloadRecord(receipt2.payload, receipt2.payloadCodecVersion);
+      if (payload.credentialId !== input.credentialId)
+        throw new Error("An attempt cannot record two different Codex selections");
+      return {
+        events: prior.map(mapEvent2),
+        diagnostics: {
+          transition: payload.transition,
+          source: payload.source,
+          reason: payload.reason
+        }
+      };
+    }
+    const previousCredentialId = fence.session.codexLastCredentialId;
+    const diagnostics = codexSelectionDiagnostics({ ...input, previousCredentialId });
+    const events = [];
+    if (previousCredentialId !== null && previousCredentialId !== input.credentialId) {
+      events.push({
+        type: "codex.account.switched",
+        clientEventId: `${key2}:switch`,
+        payload: {
+          fromAccountId: previousCredentialId,
+          toAccountId: input.credentialId,
+          reason: diagnostics.source === "manual_pin" ? "manual" : "rotation"
+        }
+      });
+    }
+    events.push({
+      type: "codex.credential.selected",
+      clientEventId: key2,
+      payload: {
+        credentialId: input.credentialId,
+        strategy: input.strategy,
+        ...diagnostics,
+        previousCredentialId,
+        eligibleCount: input.eligibleCount,
+        connectedCount: input.connectedCount,
+        reused: input.reusedLease
+      }
+    });
+    await tx.update(sessions).set({ codexLastCredentialId: input.credentialId }).where(
+      and56(
+        eq57(sessions.workspaceId, input.workspaceId),
+        eq57(sessions.id, input.sessionId)
+      )
+    );
+    const appended = await appendSessionEventsForTurnAttempt(
+      tx,
+      input.workspaceId,
+      input.sessionId,
+      input.turnId,
+      input.executionGeneration,
+      input.attemptId,
+      events
+    );
+    if (!appended.accepted) throw new CodexCredentialLeaseAttemptFencedError();
+    return { events: appended.events, diagnostics };
+  });
+}
 async function recordSessionActiveCodexCredential(db, workspaceId, sessionId, credentialId) {
   await withWorkspaceSessionActivityRls(db, workspaceId, async (scopedDb) => {
     await scopedDb.update(sessions).set({ codexLastCredentialId: credentialId }).where(
@@ -64990,9 +65121,95 @@ async function listSessionsForSubject(db, workspaceId, options) {
   }
   throw new Error("unreachable session list retry state");
 }
+async function sessionFailureDiagnostics(db, workspaceId, session) {
+  if (session.status !== "failed") return null;
+  const scope = and56(
+    eq57(sessionEvents.workspaceId, workspaceId),
+    eq57(sessionEvents.sessionId, session.id),
+    lte4(sessionEvents.sequence, session.lastSequence),
+    isNull16(sessionEvents.duplicateOfEventId),
+    or12(
+      isNull16(sessionEvents.turnAssociation),
+      eq57(sessionEvents.turnAssociation, "current")
+    )
+  );
+  const maxChars = 1024;
+  const storageChars = sessionTextStoragePrefixChars(maxChars);
+  const diagnosticFields = ["error", "message", "detail", "lastRetryableError", "code", "status"];
+  const boundedFields = diagnosticFields.flatMap((field) => {
+    const scalar = sql81`case when jsonb_typeof(${sessionEvents.payload}->${field}::text) = 'string'
+      then ${sessionEvents.payload}->>${field}::text else null end`;
+    return [
+      sql81`${field}::text`,
+      sql81`jsonb_build_object(
+      'prefix', left(${scalar}, ${storageChars}), 'chars', char_length(${scalar}),
+      'encoded', ${sessionMcpProgressScalarIsEncodedSql(scalar, sessionEvents.payloadCodecVersion)})`
+    ];
+  });
+  const projectedPayload = sql81`jsonb_build_object(
+    ${sql81.join(boundedFields, sql81`, `)},
+    'providerRecoveryCount', case when jsonb_typeof(${sessionEvents.payload}->'providerRecoveryCount') = 'number'
+      and length((${sessionEvents.payload}->'providerRecoveryCount')::text) <= 16
+      then ${sessionEvents.payload}->'providerRecoveryCount' else 'null'::jsonb end)`;
+  const latest = async (type) => {
+    const [row] = await db.select({
+      id: sessionEvents.id,
+      sequence: sessionEvents.sequence,
+      turnId: sessionEvents.turnId,
+      occurredAt: sessionEvents.occurredAt,
+      codecVersion: sessionEvents.payloadCodecVersion,
+      payload: projectedPayload
+    }).from(sessionEvents).where(and56(scope, eq57(sessionEvents.type, type))).orderBy(desc22(sessionEvents.sequence)).limit(1);
+    if (!row) return null;
+    const payload = {
+      providerRecoveryCount: row.payload.providerRecoveryCount
+    };
+    const truncatedFields = [];
+    for (const field of diagnosticFields) {
+      const stored = row.payload[field];
+      const projected = projectSessionTextPrefix(
+        stored.prefix,
+        stored.chars,
+        row.codecVersion,
+        stored.encoded,
+        maxChars
+      );
+      payload[field] = projected.text;
+      if (projected.textTruncated || (projected.originalChars ?? 0) > maxChars)
+        truncatedFields.push(field);
+    }
+    payload.projection = { fieldsOnly: true, fieldLimitChars: maxChars, truncatedFields };
+    return { ...row, payload, occurredAt: row.occurredAt.toISOString() };
+  };
+  const turnFailure = await latest("turn.failed");
+  const latestStatus = await latest("session.status.changed");
+  const statusPayload = latestStatus?.payload;
+  if (latestStatus && (!turnFailure || latestStatus.sequence > turnFailure.sequence) && typeof statusPayload?.status === "string" && statusPayload.status !== "failed")
+    return null;
+  const preClaimFailure = statusPayload?.status === "failed" && statusPayload.code === "pre_claim_failure" ? latestStatus : null;
+  const failure = preClaimFailure && (!turnFailure || preClaimFailure.sequence > turnFailure.sequence && (!preClaimFailure.turnId || preClaimFailure.turnId !== turnFailure.turnId)) ? preClaimFailure : turnFailure;
+  if (!failure) return null;
+  return {
+    eventId: failure.id,
+    sequence: failure.sequence,
+    turnId: failure.turnId ?? null,
+    occurredAt: failure.occurredAt,
+    payload: failure.payload
+  };
+}
 async function getSessionForSubject(db, workspaceId, sessionId, subjectId, relatedSessionAccess = "root") {
   return await withWorkspaceSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
-    const [row] = await scopedDb.select({ session: sessions, pin: sessionPins }).from(sessions).leftJoin(
+    const [row] = await scopedDb.select({
+      session: sessions,
+      pin: sessionPins,
+      cursor: sessionEventCursors
+    }).from(sessions).leftJoin(
+      sessionEventCursors,
+      and56(
+        eq57(sessionEventCursors.workspaceId, sessions.workspaceId),
+        eq57(sessionEventCursors.sessionId, sessions.id)
+      )
+    ).leftJoin(
       sessionPins,
       and56(
         eq57(sessionPins.workspaceId, workspaceId),
@@ -65014,25 +65231,36 @@ async function getSessionForSubject(db, workspaceId, sessionId, subjectId, relat
       )
     ).limit(1);
     if (!row) return null;
-    const [session] = await canonicalSessionRowsFromEventCursors(scopedDb, workspaceId, [
-      row.session
-    ]);
+    if (!row.cursor || row.cursor.accountId !== row.session.accountId || row.cursor.lastSequence < row.session.lastSequence) {
+      throw new Error(`Session event cursor invariant failed for session ${sessionId}`);
+    }
+    const [session] = await withLatestStartedSessionPolicy(
+      scopedDb,
+      workspaceId,
+      await withCurrentSessionInputWait(scopedDb, workspaceId, [
+        { ...row.session, lastSequence: row.cursor.lastSequence }
+      ])
+    );
     if (!session) throw new Error(`Session event cursor missing for session ${sessionId}`);
     const mcpServers = await sessionMcpServerMetadataForSessions(scopedDb, workspaceId, [
       sessionId
     ]);
     const tenancyActivated = await sessionTenancyProductActivated(scopedDb, workspaceId);
+    const failureDiagnostics = await sessionFailureDiagnostics(scopedDb, workspaceId, session);
     return projectSessionForRelatedAccess(
-      await mapSessionWithControl(
-        scopedDb,
-        session,
-        mcpServers.get(sessionId) ?? [],
-        mapSessionPin(row.pin),
-        mapSessionAttention(session, row.pin),
-        mapSessionArchive(row.pin),
-        void 0,
-        { subjectId, activated: tenancyActivated }
-      ),
+      {
+        ...await mapSessionWithControl(
+          scopedDb,
+          session,
+          mcpServers.get(sessionId) ?? [],
+          mapSessionPin(row.pin),
+          mapSessionAttention(session, row.pin),
+          mapSessionArchive(row.pin),
+          void 0,
+          { subjectId, activated: tenancyActivated }
+        ),
+        failureDiagnostics
+      },
       relatedSessionAccess
     );
   });
@@ -69869,14 +70097,7 @@ function archiveCaptureRemainingMs(row) {
     return null;
   }
   const remainingMs = Number(row.archive_capture_remaining_ms);
-  return Number.isSafeInteger(remainingMs) && remainingMs >= 0 && remainingMs <= SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS ? remainingMs : null;
-}
-function extendSandboxTransitionDeadline(currentDeadline, hardDeadline, remainingCaptureMs, now) {
-  if (remainingCaptureMs === null || remainingCaptureMs === void 0) return currentDeadline;
-  return Math.min(
-    hardDeadline,
-    Math.max(currentDeadline, now + remainingCaptureMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS)
-  );
+  return Number.isSafeInteger(remainingMs) && remainingMs >= 0 && remainingMs <= SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS2 ? remainingMs : null;
 }
 function providerlessLeaseBackendPredicateSql() {
   const providerlessBackends = Object.entries(SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND).filter(([, fields]) => fields.length === 0).map(([backend]) => backend);
@@ -70352,25 +70573,19 @@ async function acquireLease(db, input) {
     throw new Error("Sandbox lease archive capture wait is invalid");
   }
   const startedAt = performance.now();
-  const hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
-  let deadline = Math.min(hardDeadline, startedAt + captureWaitMs);
+  const waitBudget = new SandboxTransitionWaitBudget(captureWaitMs, startedAt);
   let delayMs = 25;
   for (; ; ) {
     const result = await acquireLeaseOnce(db, input);
     const now = performance.now();
     if (captureWaitMs > 0 && result.role === "fenced" && result.reason === "capture_in_progress") {
-      deadline = extendSandboxTransitionDeadline(
-        deadline,
-        hardDeadline,
-        result.captureRemainingMs,
-        now
-      );
+      waitBudget.observeCapture(result.captureRemainingMs, now);
     }
-    if (result.role !== "fenced" || result.reason === "superseded" || result.reason === "rotation_in_progress" || now >= deadline) {
+    if (result.role !== "fenced" || result.reason === "superseded" || result.reason === "rotation_in_progress" || now >= waitBudget.deadline) {
       return result;
     }
     await waitForSandboxTransition(
-      Math.min(delayMs, Math.max(1, deadline - now)),
+      Math.min(delayMs, Math.max(1, waitBudget.deadline - now)),
       input.waitSignal,
       "Sandbox lease transition wait cancelled"
     );
@@ -74146,8 +74361,7 @@ async function advanceWorkspaceGenerationForAuthority(db, authority, operationIn
     throw new Error("Workspace archive capture wait is invalid");
   }
   const startedAt = performance.now();
-  const hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
-  let deadline = Math.min(hardDeadline, startedAt + captureWaitMs);
+  const waitBudget = new SandboxTransitionWaitBudget(captureWaitMs, startedAt);
   let delayMs = 25;
   let captureWaitStartedAt;
   let captureWaitOutcome = "failed";
@@ -74164,19 +74378,14 @@ async function advanceWorkspaceGenerationForAuthority(db, authority, operationIn
       } catch (error) {
         const now = performance.now();
         if (captureWaitMs > 0 && error instanceof SandboxWorkspaceMutationFencedError && error.code === "capture_in_progress") {
-          deadline = extendSandboxTransitionDeadline(
-            deadline,
-            hardDeadline,
-            error.captureRemainingMs,
-            now
-          );
+          waitBudget.observeCapture(error.captureRemainingMs, now);
         }
-        if (!(error instanceof SandboxWorkspaceMutationFencedError) || error.code !== "capture_in_progress" || now >= deadline) {
+        if (!(error instanceof SandboxWorkspaceMutationFencedError) || error.code !== "capture_in_progress" || now >= waitBudget.deadline) {
           throw error;
         }
         captureWaitStartedAt ??= performance.now();
         await waitForSandboxTransition(
-          Math.min(delayMs, Math.max(1, deadline - now)),
+          Math.min(delayMs, Math.max(1, waitBudget.deadline - now)),
           waitSignal,
           "Sandbox workspace mutation wait cancelled"
         );
@@ -75422,7 +75631,7 @@ async function claimWorkspaceArchiveCapture(db, input) {
     throw new Error("Workspace archive capture timeout is invalid");
   }
   const operationId = input.operationId ?? input.captureId;
-  const providerRequestId = operationId;
+  const providerRequestId = randomUUID12();
   const captureAttempt = input.attempt ?? 1;
   const providerReplaySafe = input.providerReplaySafe === true;
   const takeoverSafe = input.takeoverSafe === true;
@@ -93323,6 +93532,7 @@ export {
   closeSessionTurnAttemptInTransaction,
   closeSlackInteractionDelivery,
   codexCapacityRefreshBackoffMs,
+  codexSelectionDiagnostics,
   commitBrowserRevisionPublication,
   commitBrowserSessionSuspension,
   commitBrowserStateUploadInTransaction,
@@ -94293,6 +94503,7 @@ export {
   recordRetainedProcessReconciliationProof,
   recordRetainedScreenshotArtifactError,
   recordSessionActiveCodexCredential,
+  recordSessionCodexSelectionForTurnAttempt,
   recordSessionGoalProgressWithEvent,
   recordSkippedContextCompaction,
   recordSlackBotInstallCallbackFailure,