@opengeni/db 4.3.3-canary.0 → 4.3.3-canary.2

package/src/index.ts

@@ -1,3 +1,5 @@
+import { codexSelectionDiagnostics } from "./codex-selection-diagnostics";
+export { codexSelectionDiagnostics } from "./codex-selection-diagnostics";
 import {
   latestStartedSessionTurnQuery,
   withLatestStartedSessionPolicy,
@@ -335,7 +337,6 @@ import {
 } from "@opengeni/contracts";
 import {
   environmentsEncryptionKeyBytes,
-  SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,
   SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,
   WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
   WORKSPACE_OPENROUTER_CONNECTION_ROLE,
@@ -343,6 +344,7 @@ import {
   VERCEL_AI_GATEWAY_CONNECTION_ROLE,
   type Settings,
 } from "@opengeni/config";
+import { SandboxTransitionWaitBudget } from "./sandbox-transition-wait";
 import { normalizeWorkspaceMembershipPermissions } from "./workspace-membership-permissions";
 import {
   canonicalizePersistedHistoryItem,
@@ -399,6 +401,8 @@ import {
 export { LOSSLESS_TEXT_PREFIX } from "./lossless-json";
 import {
   projectSessionMcpProgressText,
+  projectSessionTextPrefix,
+  sessionTextStoragePrefixChars,
   SESSION_MCP_PROGRESS_STORAGE_CHARS,
   sessionMcpProgressScalarIsEncodedSql,
 } from "./session-mcp-progress";
@@ -29660,6 +29664,114 @@ export async function setSessionCodexPin(
 }
 
 /** Written by the worker at the turn boundary; drives the in-session indicator. */
+/** Commit observed assignment and its events together under the exact live attempt.
+ * Allocation still uses its frozen policy snapshot; this is observation only.
+ * Replays return the same receipt and never manufacture a second switch.
+ */
+export async function recordSessionCodexSelectionForTurnAttempt(
+  db: Database,
+  input: {
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    credentialId: string;
+    strategy: string;
+    reusedLease: boolean;
+    pinnedCredentialId: string | null;
+    pinSource: "manual" | "policy" | null;
+    eligibleCount: number;
+    connectedCount: number;
+  },
+): Promise<{ events: SessionEvent[]; diagnostics: ReturnType<typeof codexSelectionDiagnostics> }> {
+  return await withWorkspaceSessionEventActivityRls(db, input.workspaceId, true, async (tx) => {
+    const fence = await lockTurnAttemptWriteFenceTx(tx, {
+      workspaceId: input.workspaceId,
+      sessionId: input.sessionId,
+      turnId: input.turnId,
+      executionGeneration: input.executionGeneration,
+      attemptId: input.attemptId,
+      sessionLock: "no_key_update",
+    });
+    if (!fence.allowed || !fence.session) throw new CodexCredentialLeaseAttemptFencedError();
+    const key = `opengeni:codex-selection:${input.attemptId}`;
+    const prior = await tx
+      .select()
+      .from(schema.sessionEvents)
+      .where(
+        and(
+          eq(schema.sessionEvents.workspaceId, input.workspaceId),
+          eq(schema.sessionEvents.sessionId, input.sessionId),
+          inArray(schema.sessionEvents.clientEventId, [key, `${key}:switch`]),
+        ),
+      )
+      .orderBy(asc(schema.sessionEvents.sequence));
+    if (prior.length) {
+      const receipt = prior.find((event) => event.type === "codex.credential.selected");
+      if (!receipt) throw new Error("Codex selection receipt missing");
+      const payload = sessionEventPayloadRecord(receipt.payload, receipt.payloadCodecVersion);
+      if (payload.credentialId !== input.credentialId)
+        throw new Error("An attempt cannot record two different Codex selections");
+      return {
+        events: prior.map(mapEvent),
+        diagnostics: {
+          transition: payload.transition,
+          source: payload.source,
+          reason: payload.reason,
+        } as ReturnType<typeof codexSelectionDiagnostics>,
+      };
+    }
+    const previousCredentialId = fence.session.codexLastCredentialId;
+    const diagnostics = codexSelectionDiagnostics({ ...input, previousCredentialId });
+    const events: AppendEventInput[] = [];
+    if (previousCredentialId !== null && previousCredentialId !== input.credentialId) {
+      events.push({
+        type: "codex.account.switched",
+        clientEventId: `${key}:switch`,
+        payload: {
+          fromAccountId: previousCredentialId,
+          toAccountId: input.credentialId,
+          reason: diagnostics.source === "manual_pin" ? "manual" : "rotation",
+        },
+      });
+    }
+    events.push({
+      type: "codex.credential.selected",
+      clientEventId: key,
+      payload: {
+        credentialId: input.credentialId,
+        strategy: input.strategy,
+        ...diagnostics,
+        previousCredentialId,
+        eligibleCount: input.eligibleCount,
+        connectedCount: input.connectedCount,
+        reused: input.reusedLease,
+      },
+    });
+    await tx
+      .update(schema.sessions)
+      .set({ codexLastCredentialId: input.credentialId })
+      .where(
+        and(
+          eq(schema.sessions.workspaceId, input.workspaceId),
+          eq(schema.sessions.id, input.sessionId),
+        ),
+      );
+    const appended = await appendSessionEventsForTurnAttempt(
+      tx,
+      input.workspaceId,
+      input.sessionId,
+      input.turnId,
+      input.executionGeneration,
+      input.attemptId,
+      events,
+    );
+    if (!appended.accepted) throw new CodexCredentialLeaseAttemptFencedError();
+    return { events: appended.events, diagnostics };
+  });
+}
+
 export async function recordSessionActiveCodexCredential(
   db: Database,
   workspaceId: string,
@@ -35195,6 +35307,120 @@ export async function listSessionsForSubject(
 }
 
 /** Read a session with the caller subject's personal pin projection. */
+/** Read failure evidence at the already-authorized detail cursor, never a browser page.
+ * Event rows are immutable; the sequence fence keeps these reads coherent even
+ * if another turn is accepted while the detail projection is being assembled.
+ * Keep this off fleet/list/worker reads. Existing type/turn indexes cover it.
+ */
+async function sessionFailureDiagnostics(
+  db: Database,
+  workspaceId: string,
+  session: { id: string; lastSequence: number; status: string },
+): Promise<Session["failureDiagnostics"]> {
+  if (session.status !== "failed") return null;
+  const scope = and(
+    eq(schema.sessionEvents.workspaceId, workspaceId),
+    eq(schema.sessionEvents.sessionId, session.id),
+    lte(schema.sessionEvents.sequence, session.lastSequence),
+    isNull(schema.sessionEvents.duplicateOfEventId),
+    or(
+      isNull(schema.sessionEvents.turnAssociation),
+      eq(schema.sessionEvents.turnAssociation, "current"),
+    ),
+  );
+  // Transfer only codec-aware prefixes. Cutting an encoded storage scalar
+  // directly would show base64 rather than the accepted logical error text.
+  const maxChars = 1024;
+  const storageChars = sessionTextStoragePrefixChars(maxChars);
+  const diagnosticFields = ["error", "message", "detail", "lastRetryableError", "code", "status"];
+  const boundedFields = diagnosticFields.flatMap((field) => {
+    const scalar = sql`case when jsonb_typeof(${schema.sessionEvents.payload}->${field}::text) = 'string'
+      then ${schema.sessionEvents.payload}->>${field}::text else null end`;
+    return [
+      sql`${field}::text`,
+      sql`jsonb_build_object(
+      'prefix', left(${scalar}, ${storageChars}), 'chars', char_length(${scalar}),
+      'encoded', ${sessionMcpProgressScalarIsEncodedSql(scalar, schema.sessionEvents.payloadCodecVersion)})`,
+    ];
+  });
+  const projectedPayload = sql<Record<string, unknown>>`jsonb_build_object(
+    ${sql.join(boundedFields, sql`, `)},
+    'providerRecoveryCount', case when jsonb_typeof(${schema.sessionEvents.payload}->'providerRecoveryCount') = 'number'
+      and length((${schema.sessionEvents.payload}->'providerRecoveryCount')::text) <= 16
+      then ${schema.sessionEvents.payload}->'providerRecoveryCount' else 'null'::jsonb end)`;
+  const latest = async (type: string) => {
+    const [row] = await db
+      .select({
+        id: schema.sessionEvents.id,
+        sequence: schema.sessionEvents.sequence,
+        turnId: schema.sessionEvents.turnId,
+        occurredAt: schema.sessionEvents.occurredAt,
+        codecVersion: schema.sessionEvents.payloadCodecVersion,
+        payload: projectedPayload,
+      })
+      .from(schema.sessionEvents)
+      .where(and(scope, eq(schema.sessionEvents.type, type)))
+      .orderBy(desc(schema.sessionEvents.sequence))
+      .limit(1);
+    if (!row) return null;
+    const payload: Record<string, unknown> = {
+      providerRecoveryCount: row.payload.providerRecoveryCount,
+    };
+    const truncatedFields: string[] = [];
+    for (const field of diagnosticFields) {
+      const stored = row.payload[field] as {
+        prefix: string | null;
+        chars: number | null;
+        encoded: boolean;
+      };
+      const projected = projectSessionTextPrefix(
+        stored.prefix,
+        stored.chars,
+        row.codecVersion,
+        stored.encoded,
+        maxChars,
+      );
+      payload[field] = projected.text;
+      if (projected.textTruncated || (projected.originalChars ?? 0) > maxChars)
+        truncatedFields.push(field);
+    }
+    // Six 1024-character logical strings remain below 40KiB even when JSON
+    // escapes every character as six bytes. Stored values remain untouched.
+    payload.projection = { fieldsOnly: true, fieldLimitChars: maxChars, truncatedFields };
+    return { ...row, payload, occurredAt: row.occurredAt.toISOString() };
+  };
+  const turnFailure = await latest("turn.failed");
+  const latestStatus = await latest("session.status.changed");
+  const statusPayload = latestStatus?.payload as Record<string, unknown> | undefined;
+  // Do not associate an earlier failure with a later recorded revival.
+  if (
+    latestStatus &&
+    (!turnFailure || latestStatus.sequence > turnFailure.sequence) &&
+    typeof statusPayload?.status === "string" &&
+    statusPayload.status !== "failed"
+  )
+    return null;
+  const preClaimFailure =
+    statusPayload?.status === "failed" && statusPayload.code === "pre_claim_failure"
+      ? latestStatus
+      : null;
+  const failure =
+    preClaimFailure &&
+    (!turnFailure ||
+      (preClaimFailure.sequence > turnFailure.sequence &&
+        (!preClaimFailure.turnId || preClaimFailure.turnId !== turnFailure.turnId)))
+      ? preClaimFailure
+      : turnFailure;
+  if (!failure) return null;
+  return {
+    eventId: failure.id,
+    sequence: failure.sequence,
+    turnId: failure.turnId ?? null,
+    occurredAt: failure.occurredAt,
+    payload: failure.payload,
+  };
+}
+
 export async function getSessionForSubject(
   db: Database,
   workspaceId: string,
@@ -35204,8 +35430,22 @@ export async function getSessionForSubject(
 ): Promise<Session | null> {
   return await withWorkspaceSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const [row] = await scopedDb
-      .select({ session: schema.sessions, pin: schema.sessionPins })
+      .select({
+        session: schema.sessions,
+        pin: schema.sessionPins,
+        cursor: schema.sessionEventCursors,
+      })
       .from(schema.sessions)
+      // Status and replay cursor must share one statement snapshot. Otherwise a
+      // concurrent revival can pair an old failed row with a new running cursor,
+      // causing the browser to skip the very event that would refresh its status.
+      .leftJoin(
+        schema.sessionEventCursors,
+        and(
+          eq(schema.sessionEventCursors.workspaceId, schema.sessions.workspaceId),
+          eq(schema.sessionEventCursors.sessionId, schema.sessions.id),
+        ),
+      )
       .leftJoin(
         schema.sessionPins,
         and(
@@ -35230,25 +35470,40 @@ export async function getSessionForSubject(
       )
       .limit(1);
     if (!row) return null;
-    const [session] = await canonicalSessionRowsFromEventCursors(scopedDb, workspaceId, [
-      row.session,
-    ]);
+    if (
+      !row.cursor ||
+      row.cursor.accountId !== row.session.accountId ||
+      row.cursor.lastSequence < row.session.lastSequence
+    ) {
+      throw new Error(`Session event cursor invariant failed for session ${sessionId}`);
+    }
+    const [session] = await withLatestStartedSessionPolicy(
+      scopedDb,
+      workspaceId,
+      await withCurrentSessionInputWait(scopedDb, workspaceId, [
+        { ...row.session, lastSequence: row.cursor.lastSequence },
+      ]),
+    );
     if (!session) throw new Error(`Session event cursor missing for session ${sessionId}`);
     const mcpServers = await sessionMcpServerMetadataForSessions(scopedDb, workspaceId, [
       sessionId,
     ]);
     const tenancyActivated = await sessionTenancyProductActivated(scopedDb, workspaceId);
+    const failureDiagnostics = await sessionFailureDiagnostics(scopedDb, workspaceId, session);
     return projectSessionForRelatedAccess(
-      await mapSessionWithControl(
-        scopedDb,
-        session,
-        mcpServers.get(sessionId) ?? [],
-        mapSessionPin(row.pin),
-        mapSessionAttention(session, row.pin),
-        mapSessionArchive(row.pin),
-        undefined,
-        { subjectId, activated: tenancyActivated },
-      ),
+      {
+        ...(await mapSessionWithControl(
+          scopedDb,
+          session,
+          mcpServers.get(sessionId) ?? [],
+          mapSessionPin(row.pin),
+          mapSessionAttention(session, row.pin),
+          mapSessionArchive(row.pin),
+          undefined,
+          { subjectId, activated: tenancyActivated },
+        )),
+        failureDiagnostics,
+      },
       relatedSessionAccess,
     );
   });
@@ -43119,19 +43374,6 @@ function archiveCaptureRemainingMs(
     : null;
 }
 
-function extendSandboxTransitionDeadline(
-  currentDeadline: number,
-  hardDeadline: number,
-  remainingCaptureMs: number | null | undefined,
-  now: number,
-): number {
-  if (remainingCaptureMs === null || remainingCaptureMs === undefined) return currentDeadline;
-  return Math.min(
-    hardDeadline,
-    Math.max(currentDeadline, now + remainingCaptureMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS),
-  );
-}
-
 function providerlessLeaseBackendPredicateSql() {
   const providerlessBackends = Object.entries(SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND)
     .filter(([, fields]) => fields.length === 0)
@@ -43976,33 +44218,27 @@ export async function acquireLease(
   // NTP/VM resume may change timestamp interpretation, but must never stretch
   // or prematurely consume the caller's resource budget. PostgreSQL projects
   // an active claim's remaining time on its own authoritative clock; that may
-  // extend a positive caller budget after a rolling config change, but never
-  // beyond the same one-hour lifecycle ceiling.
+  // extend a positive caller budget once after a rolling config change. Later
+  // capture retries must not keep renewing a waiter's observational budget.
   const startedAt = performance.now();
-  const hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
-  let deadline = Math.min(hardDeadline, startedAt + captureWaitMs);
+  const waitBudget = new SandboxTransitionWaitBudget(captureWaitMs, startedAt);
   let delayMs = 25;
   for (;;) {
     const result = await acquireLeaseOnce(db, input);
     const now = performance.now();
     if (captureWaitMs > 0 && result.role === "fenced" && result.reason === "capture_in_progress") {
-      deadline = extendSandboxTransitionDeadline(
-        deadline,
-        hardDeadline,
-        result.captureRemainingMs,
-        now,
-      );
+      waitBudget.observeCapture(result.captureRemainingMs, now);
     }
     if (
       result.role !== "fenced" ||
       result.reason === "superseded" ||
       result.reason === "rotation_in_progress" ||
-      now >= deadline
+      now >= waitBudget.deadline
     ) {
       return result;
     }
     await waitForSandboxTransition(
-      Math.min(delayMs, Math.max(1, deadline - now)),
+      Math.min(delayMs, Math.max(1, waitBudget.deadline - now)),
       input.waitSignal,
       "Sandbox lease transition wait cancelled",
     );
@@ -50128,8 +50364,7 @@ async function advanceWorkspaceGenerationForAuthority(
     throw new Error("Workspace archive capture wait is invalid");
   }
   const startedAt = performance.now();
-  const hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
-  let deadline = Math.min(hardDeadline, startedAt + captureWaitMs);
+  const waitBudget = new SandboxTransitionWaitBudget(captureWaitMs, startedAt);
   let delayMs = 25;
   let captureWaitStartedAt: number | undefined;
   let captureWaitOutcome: "completed" | "failed" = "failed";
@@ -50150,23 +50385,18 @@ async function advanceWorkspaceGenerationForAuthority(
           error instanceof SandboxWorkspaceMutationFencedError &&
           error.code === "capture_in_progress"
         ) {
-          deadline = extendSandboxTransitionDeadline(
-            deadline,
-            hardDeadline,
-            error.captureRemainingMs,
-            now,
-          );
+          waitBudget.observeCapture(error.captureRemainingMs, now);
         }
         if (
           !(error instanceof SandboxWorkspaceMutationFencedError) ||
           error.code !== "capture_in_progress" ||
-          now >= deadline
+          now >= waitBudget.deadline
         ) {
           throw error;
         }
         captureWaitStartedAt ??= performance.now();
         await waitForSandboxTransition(
-          Math.min(delayMs, Math.max(1, deadline - now)),
+          Math.min(delayMs, Math.max(1, waitBudget.deadline - now)),
           waitSignal,
           "Sandbox workspace mutation wait cancelled",
         );
@@ -52240,12 +52470,12 @@ export async function claimWorkspaceArchiveCapture(
     throw new Error("Workspace archive capture timeout is invalid");
   }
   const operationId = input.operationId ?? input.captureId;
-  // captureId owns one DB callback; providerRequestId owns the external
-  // operation. Modal's wire contract explicitly defines snapshotId as an
-  // idempotency key, so every Temporal retry of one logical capture must reuse
-  // it. Other providers still retain the stable lineage for late-result
-  // adoption, but may not replay the physical request before its deadline.
-  const providerRequestId = operationId;
+  // A fresh admission-fenced capture gets a fresh provider request identity.
+  // After a released failure, writers may re-arm this same lease epoch before
+  // the drain workflow retries. Reusing its operationId could then retrieve an
+  // older provider snapshot as the newer workspace generation. Replacements of
+  // an uninterrupted claim retain this stored identity for late-result adoption.
+  const providerRequestId = randomUUID();
   const captureAttempt = input.attempt ?? 1;
   const providerReplaySafe = input.providerReplaySafe === true;
   const takeoverSafe = input.takeoverSafe === true;

package/src/plugin-packages.ts

@@ -48,6 +48,7 @@ export type InstalledPluginPackageSummary = {
   category: string;
   tags: string[];
   sourceUrl: string | null;
+  logoUrl: string | null;
   manifestDigest: string;
   installationVersion: number;
   componentCount: number;
@@ -158,6 +159,7 @@ export async function listInstalledPluginPackages(
     return rows.map((row) => {
       const manifest = objectValue(row.manifest);
       const sourceUrl = stringValue(manifest.sourceUrl);
+      const logoUrl = stringValue(objectValue(manifest.discovery).logoUrl);
       const bom = pluginBom(manifest);
       if (row.status !== "active" && row.status !== "needs_attention") {
         throw new Error(`Unknown installed Plugin status: ${row.status}`);
@@ -173,6 +175,7 @@ export async function listInstalledPluginPackages(
             ? stringArray(manifest.tags)
             : stringArray(row.tags),
         sourceUrl: sourceUrl && safeHttpUrl(sourceUrl) ? sourceUrl : null,
+        logoUrl: logoUrl && safeHttpUrl(logoUrl) ? logoUrl : null,
         manifestDigest: row.manifestDigest,
         installationVersion: row.installationVersion,
         componentCount: bom.length,

package/src/sandbox-transition-wait.ts

@@ -0,0 +1,45 @@
+import {
+  SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,
+  SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,
+} from "@opengeni/config";
+
+/** Observational only: expiring a caller's wait never revokes a capture fence. */
+export class SandboxTransitionWaitBudget {
+  private observedCapture = false;
+  private currentDeadline: number;
+  private readonly hardDeadline: number;
+
+  constructor(
+    private readonly waitMs: number,
+    startedAt: number,
+  ) {
+    this.hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
+    this.currentDeadline = Math.min(this.hardDeadline, startedAt + waitMs);
+  }
+
+  get deadline(): number {
+    return this.currentDeadline;
+  }
+
+  observeCapture(remainingMs: number | null | undefined, now: number): void {
+    if (
+      this.waitMs === 0 ||
+      this.observedCapture ||
+      remainingMs === null ||
+      remainingMs === undefined ||
+      !Number.isSafeInteger(remainingMs) ||
+      remainingMs < 0 ||
+      remainingMs > SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS
+    )
+      return;
+
+    // Honor the first observed child's frozen timeout across rolling settings
+    // changes. Neither an expired claim (remaining=0) nor a replacement capture
+    // can replenish the grace/budget on every poll and starve this caller.
+    this.observedCapture = true;
+    this.currentDeadline = Math.min(
+      this.hardDeadline,
+      Math.max(this.currentDeadline, now + remainingMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS),
+    );
+  }
+}

package/src/session-mcp-progress.ts

@@ -11,8 +11,12 @@ export const SESSION_MCP_PROGRESS_CHARS = 600;
 // so a prefix cannot split the last delivered surrogate pair. Eight base64
 // characters encode three complete UTF-16 units, so a cut encoded prefix is
 // independently decodable by the canonical codec (no partial bytes/units).
-export const SESSION_MCP_PROGRESS_STORAGE_CHARS =
-  LOSSLESS_JSON_STRING_PREFIX.length + Math.ceil(((SESSION_MCP_PROGRESS_CHARS + 1) * 2) / 3) * 8;
+export function sessionTextStoragePrefixChars(maxChars: number): number {
+  return LOSSLESS_JSON_STRING_PREFIX.length + Math.ceil(((maxChars + 1) * 2) / 3) * 8;
+}
+export const SESSION_MCP_PROGRESS_STORAGE_CHARS = sessionTextStoragePrefixChars(
+  SESSION_MCP_PROGRESS_CHARS,
+);
 
 // Match the canonical decoder's nonempty, round-tripping base64 of an even
 // byte count. Each 8-character block is 6 bytes. The final block contributes
@@ -38,12 +42,13 @@ export function sessionMcpProgressScalarIsEncodedSql(
   )`;
 }
 
-/** Project only the selected scalar, never the rest of a goal.progress payload. */
-export function projectSessionMcpProgressText(
+/** Project only the selected scalar, never the rest of its event payload. */
+export function projectSessionTextPrefix(
   storedPrefix: string | null,
   storedChars: number | null,
   codecVersion: number | null,
   scalarIsEncoded: boolean,
+  maxChars: number,
 ): { text: string | null; originalChars: number | null; textTruncated?: true } {
   if (storedPrefix === null) return { text: null, originalChars: null };
   const decoded = scalarIsEncoded
@@ -60,8 +65,24 @@ export function projectSessionMcpProgressText(
       ? storedChars
       : chars.length;
   return {
-    text: chars.slice(0, SESSION_MCP_PROGRESS_CHARS).join(""),
+    text: chars.slice(0, maxChars).join(""),
     originalChars,
     ...(encodedPrefixWasCut ? { textTruncated: true } : {}),
   };
 }
+
+/** Existing MCP progress budget, using the shared logical-text prefix projection. */
+export function projectSessionMcpProgressText(
+  storedPrefix: string | null,
+  storedChars: number | null,
+  codecVersion: number | null,
+  scalarIsEncoded: boolean,
+): { text: string | null; originalChars: number | null; textTruncated?: true } {
+  return projectSessionTextPrefix(
+    storedPrefix,
+    storedChars,
+    codecVersion,
+    scalarIsEncoded,
+    SESSION_MCP_PROGRESS_CHARS,
+  );
+}