@opengeni/db 4.4.1 → 4.5.0

package/drizzle/0908_site_opens.sql

@@ -0,0 +1,33 @@
+-- deployment-mode: rolling
+-- When each person last opened a Site in the console. It orders that
+-- person's Site rows in the sidebar like session activity and grants
+-- nothing: the Site's own audience still decides who can see it. New code
+-- owns the table; old binaries never read it.
+CREATE TABLE site_opens (
+  account_id uuid NOT NULL,
+  workspace_id uuid NOT NULL,
+  subject_id text NOT NULL CHECK (length(subject_id) BETWEEN 1 AND 512),
+  site_id uuid NOT NULL,
+  opened_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (workspace_id, subject_id, site_id),
+  FOREIGN KEY (workspace_id, account_id) REFERENCES workspaces(id, account_id) ON DELETE CASCADE,
+  FOREIGN KEY (workspace_id, site_id) REFERENCES workspace_artifacts(workspace_id, id) ON DELETE CASCADE
+);
+CREATE INDEX site_opens_site_idx ON site_opens(workspace_id, site_id);
+ALTER TABLE site_opens ENABLE ROW LEVEL SECURITY;
+ALTER TABLE site_opens FORCE ROW LEVEL SECURITY;
+-- Personal like session pins: only the opening subject reads or writes a row.
+CREATE POLICY workspace_isolation ON site_opens
+  USING (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND subject_id = opengeni_private.current_subject_id()
+  )
+  WITH CHECK (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND subject_id = opengeni_private.current_subject_id()
+  );
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON site_opens TO opengeni_app;
+  END IF;
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "4.4.1",
+  "version": "4.5.0",
   "description": "Opengeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -121,14 +121,14 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "4.4.1",
-    "@opengeni/codex": "4.4.1",
-    "@opengeni/config": "4.4.1",
-    "@opengeni/contracts": "4.4.1",
-    "@opengeni/network": "4.4.1",
-    "@opengeni/observability": "4.4.1",
-    "@opengeni/subscriptions": "4.4.1",
-    "@opengeni/xai-subscription": "4.4.1",
+    "@opengeni/codemode": "4.5.0",
+    "@opengeni/codex": "4.5.0",
+    "@opengeni/config": "4.5.0",
+    "@opengeni/contracts": "4.5.0",
+    "@opengeni/network": "4.5.0",
+    "@opengeni/observability": "4.5.0",
+    "@opengeni/subscriptions": "4.5.0",
+    "@opengeni/xai-subscription": "4.5.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/index.ts

@@ -783,6 +783,7 @@ import type {
   SessionMemoryScope,
   SessionListResponse,
   SessionListTotals,
+  SiteConversationGroup,
   SessionListEntryResponse,
   SessionTenancyPublicProjection,
   SessionEvent,
@@ -1057,6 +1058,7 @@ import {
   historyItemType,
   TOOL_RESULT_TYPE_BY_CALL_TYPE,
 } from "./session-tool-call-settlement";
+import { readSessionHistoryToolIdentityPage } from "./session-history-tool-identities";
 import {
   assertAgentCommandAuthorityInTransaction,
   canonicalSessionCommandHash,
@@ -29996,6 +29998,37 @@ function wellFormedDriverText(value: unknown): unknown {
   return Array.isArray(value) ? value.map(wellFormedDriverText) : value;
 }
 
+/**
+ * A new Site conversation is filed in the project of the chat that created the
+ * Site (the tree of its first version's session), so the Site's sidebar row and
+ * its conversations sit together. Without a Site origin, or a creating chat,
+ * the session stays unfiled.
+ */
+async function siteHomeChannelId(
+  tx: Database,
+  workspaceId: string,
+  metadata: Record<string, unknown>,
+): Promise<string | null> {
+  const origin = metadata._opengeniSiteOrigin;
+  const siteId =
+    origin && typeof origin === "object" ? (origin as { siteId?: unknown }).siteId : undefined;
+  if (typeof siteId !== "string" || !z.string().uuid().safeParse(siteId).success) return null;
+  const [home] = await rawRows<{ channelId: string | null }>(
+    tx,
+    sql`
+      select root.channel_id::text as "channelId"
+      from ${schema.workspaceArtifactVersions} version
+      join ${schema.sessions} source
+        on source.workspace_id = version.workspace_id and source.id = version.source_session_id
+      join ${schema.sessions} root
+        on root.workspace_id = source.workspace_id and root.id = source.root_session_id
+      where version.workspace_id = ${workspaceId} and version.artifact_id = ${siteId}::uuid
+        and version.revision = 1 and root.site_access_root_id is null
+      limit 1`,
+  );
+  return home?.channelId ?? null;
+}
+
 async function createSessionInTransaction(
   tx: SessionActivityDatabase,
   input: SessionCreateInput,
@@ -30285,6 +30318,10 @@ async function createSessionInTransaction(
     input.workspaceId,
     parseAcceptedMcpAccountBindings(input.mcpAccountBindings),
   );
+  const channelId =
+    input.channelId === undefined && !input.parentSessionId
+      ? await siteHomeChannelId(tx as unknown as Database, input.workspaceId, sessionMetadata)
+      : (input.channelId ?? null);
   try {
     const insertValues: typeof schema.sessions.$inferInsert = withLosslessContentWriteVersion(
       {
@@ -30321,7 +30358,7 @@ async function createSessionInTransaction(
         variableSetId,
         rigId: input.rigId ?? null,
         rigVersionId: input.rigVersionId ?? null,
-        channelId: input.channelId ?? null,
+        channelId,
         firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
         firstPartyMcpTools: input.firstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS],
         initialPersonalConnectionDelegations: input.personalConnectionDelegations ?? [],
@@ -32021,6 +32058,13 @@ export type SessionListFilterOptions = {
   siteAccessId?: string;
   /** Sessions created through this published Site, independent of project. */
   originSiteId?: string;
+  /**
+   * Ordinary discovery omits conversations that run inside a Site. `include`
+   * lists them as ordinary rows (search, pins, branches); `group` keeps them
+   * out of root rows but counts them in totals and returns `siteGroups`.
+   * Presentation only: native ownership and Site RLS still decide access.
+   */
+  siteConversations?: "include" | "group";
   /** Exact workspace project; null selects unfiled sessions. */
   channelId?: string | null;
   /** Exact frozen creator identity. */
@@ -33037,12 +33081,33 @@ async function sessionListTotalsInScope(
   db: Database,
   workspaceId: string,
   options: ListSessionsForSubjectOptions,
-): Promise<SessionListTotals> {
+  withSiteRows = false,
+): Promise<SessionListTotals & { sites: SiteConversationGroup[]; sitesTruncated: boolean }> {
   const archiveStatus = options.archiveStatus ?? (options.archivedOnly ? "archived" : "active");
+  // A grouped rail counts Site conversations in its project totals and gets
+  // their Site rows here; its ordinary rows still omit them.
+  const siteConversations = options.siteConversations ? "include" : undefined;
+  // Sites this person opened join the rows only in the plain view: a root
+  // filter (Mine, search, creator, dates, archived content, another person's
+  // scope) or an agent caller lists only Sites its listed chats created.
+  const withOpenedSites =
+    withSiteRows &&
+    !options.needsYouOnly &&
+    !options.mineOnly &&
+    !options.search?.trim() &&
+    !options.contentArchivedOnly &&
+    !options.scopeSubjectId &&
+    !options.createdBy &&
+    !options.updatedFrom &&
+    !options.updatedBefore &&
+    !options.createdFrom &&
+    !options.createdBefore &&
+    !options.authorizationScope?.agentAccessViewer;
   const rootFilters = and(
     eq(schema.sessions.workspaceId, workspaceId),
     ...sessionFilters({
       ...options,
+      ...(siteConversations ? { siteConversations } : {}),
       parentSessionId: null,
       needsYouOnly: false,
       archiveStatus: "all",
@@ -33051,7 +33116,11 @@ async function sessionListTotalsInScope(
       ? []
       : [sql`coalesce(root_archive.archived, false) = ${archiveStatus === "archived"}`]),
   );
-  const rows = await rawRows<{ needsYouCount: number; groups: SessionListTotals["groups"] }>(
+  const rows = await rawRows<{
+    needsYouCount: number;
+    groups: SessionListTotals["groups"];
+    sites: SiteConversationGroup[] | null;
+  }>(
     db,
     sql`
     -- Inline this subject's state so each lateral lookup can use the session
@@ -33072,6 +33141,11 @@ async function sessionListTotalsInScope(
         ${schema.sessions.activeTurnId} as active_turn_id,
         ${schema.sessions.inputWaitUntil} as input_wait_until,
         ${schema.sessions.inputWaitTurnId} as input_wait_turn_id,
+        ${schema.sessions.siteId} as site_id,
+        ${schema.sessions.siteAccessRootId} is not null as site_conversation,
+        ${schema.sessions.updatedAt} as updated_at,
+        ${schema.sessions.createdAt} as created_at,
+        ${schema.sessions.metadata}->'_opengeniSiteOrigin'->>'title' as origin_title,
         ${sessionRelatedListScope(options.authorizationScope)} as related,
         coalesce(root_personal.archived, false) as archived,
         coalesce(root_personal.pinned, false) as pinned,
@@ -33142,6 +33216,9 @@ async function sessionListTotalsInScope(
       from roots root left join attention_roots attention on attention.root_id = root.id
     ), measured as (
       select nodes.*,
+        root.site_conversation as root_site_conversation, root.site_id as root_site_id,
+        root.updated_at as root_updated_at, root.created_at as root_created_at,
+        root.origin_title as root_origin_title,
         cursor.last_meaningful_sequence > nodes.acknowledged_sequence as unread,
         nodes.actively_working as active_work,
         case when nodes.status = 'requires_action' then (
@@ -33198,21 +33275,150 @@ async function sessionListTotalsInScope(
         count(*) filter (where unread)::int as unread,
         count(*) filter (where active_work)::int as "activeWork"
       from measured group by channel_id
+    ), site_conv as (
+      -- Site conversations nest under their Site's row in their own project.
+      -- Pinned ones live with pins.
+      select root.*, root.channel_id as row_channel_id
+      from roots root
+      where ${
+        withSiteRows
+          ? sql`root.site_conversation and root.site_id is not null and not root.pinned
+            ${
+              options.needsYouOnly
+                ? sql`and root.id in (select id from root_attention where needs_you)`
+                : sql``
+            }`
+          : sql`false`
+      }
+    ), site_conv_totals as (
+      select site_id, row_channel_id as channel_id, count(*)::int as conversations,
+        max(updated_at) as updated_at, max(created_at) as created_at,
+        (array_agg(origin_title order by updated_at desc, id desc)
+          filter (where origin_title is not null))[1] as origin_title
+      from site_conv group by site_id, row_channel_id
+    ), site_home as (
+      -- A Site sits in the project of the chat that created it (the tree of
+      -- its first version's session), as far as this viewer can see that
+      -- chat; new Site conversations are filed there too. A Site without
+      -- conversations here is listed when this viewer lists its creating
+      -- chat, or opened it. Candidates are the live Sites in this viewer's
+      -- audience (one row each); revision 1 is a unique-index lookup.
+      select artifact.id as site_id, creator.channel_id
+      from ${schema.workspaceArtifacts} artifact
+      join lateral (
+        select version.source_session_id from ${schema.workspaceArtifactVersions} version
+        where version.workspace_id = ${workspaceId} and version.artifact_id = artifact.id
+          and version.revision = 1
+      ) first_version on true
+      left join ${schema.sessions} source
+        on source.workspace_id = ${workspaceId} and source.id = first_version.source_session_id
+      left join ${schema.sessions} creator
+        on creator.workspace_id = ${workspaceId} and creator.id = source.root_session_id
+        and creator.site_access_root_id is null
+      where ${withSiteRows && !options.needsYouOnly ? sql`true` : sql`false`}
+        and artifact.workspace_id = ${workspaceId} and artifact.status = 'active'
+        and (artifact.visibility = 'workspace_shared'
+          or artifact.owner_subject_id = ${options.subjectId})
+        and artifact.id not in (select site_id from site_conv)
+        and (exists (select 1 from roots listed where listed.id = creator.id)
+          ${
+            withOpenedSites
+              ? sql`or exists (
+            select 1 from ${schema.siteOpens} opened
+            where opened.workspace_id = ${workspaceId}
+              and opened.subject_id = ${options.subjectId} and opened.site_id = artifact.id)`
+              : sql``
+          })
+    ), site_keys as (
+      select * from site_conv_totals
+      union all
+      select site_id, channel_id, 0, null, null, null from site_home
+    ), site_rows as (
+      -- One row per Site and project. The title is the Site's current one when
+      -- its audience includes this viewer (the catalog's rule; RLS only
+      -- isolates the workspace), else the creation-time label. A row without
+      -- conversations needs a live Site the viewer can see. Activity is the
+      -- latest of its conversations, its own changes and this person opening
+      -- it. One extra row reports truncation.
+      select key.site_id as "siteId", key.channel_id as "channelId",
+        coalesce(site.title, key.origin_title, '') as title,
+        key.conversations,
+        greatest(key.updated_at, site.updated_at, opened.opened_at) as "updatedAt",
+        coalesce(key.created_at, site.created_at) as "createdAt"
+      from site_keys key
+      left join lateral (
+        select artifact.title, artifact.status, artifact.created_at, artifact.updated_at
+        from ${schema.workspaceArtifacts} artifact
+        where artifact.workspace_id = ${workspaceId} and artifact.id = key.site_id
+          and (artifact.visibility = 'workspace_shared'
+            or artifact.owner_subject_id = ${options.subjectId})
+      ) site on true
+      left join lateral (
+        select opened.opened_at from ${schema.siteOpens} opened
+        where opened.workspace_id = ${workspaceId} and opened.subject_id = ${options.subjectId}
+          and opened.site_id = key.site_id
+      ) opened on true
+      where (key.conversations > 0 or site.status = 'active')
+        ${options.channelId !== undefined ? sql`and key.channel_id is not distinct from ${options.channelId}::uuid` : sql``}
+      order by 5 desc, 1, 2
+      limit ${SITE_CONVERSATION_GROUP_LIMIT + 1}
+    ), site_status as (
+      -- Status counts follow project totals: active, unpinned trees only.
+      select conv.site_id, conv.row_channel_id, count(*)::int as total,
+        count(*) filter (where node.status = 'requires_action')::int as attention,
+        min(node.attention_since) as "attentionSince",
+        count(*) filter (where node.status = 'failed' and node.unread)::int as failed,
+        count(*) filter (where node.pause_revision is null and
+          (node.status in ('running', 'recovering') or node.input_wait))::int as active,
+        count(*) filter (where node.pause_revision is null and
+          node.status in ('queued', 'waiting_capacity'))::int as queued,
+        count(*) filter (where node.pause_revision is null and node.input_wait)::int as waiting,
+        count(*) filter (where node.unread)::int as unread,
+        count(*) filter (where node.active_work)::int as "activeWork"
+      from measured node join site_conv conv on conv.id = node.root_id
+      group by conv.site_id, conv.row_channel_id
+    ), site_grouped as (
+      select site_rows.*, coalesce(status.total, 0) as total,
+        coalesce(status.attention, 0) as attention, status."attentionSince",
+        coalesce(status.failed, 0) as failed, coalesce(status.active, 0) as active,
+        coalesce(status.queued, 0) as queued, coalesce(status.waiting, 0) as waiting,
+        coalesce(status.unread, 0) as unread, coalesce(status."activeWork", 0) as "activeWork"
+      from site_rows left join site_status status
+        on status.site_id = site_rows."siteId"
+        and status.row_channel_id is not distinct from site_rows."channelId"
     )
     select (select count(*)::int from root_attention where needs_you) as "needsYouCount",
-      coalesce((select jsonb_agg(to_jsonb(grouped)) from grouped), '[]'::jsonb) as groups
+      coalesce((select jsonb_agg(to_jsonb(grouped)) from grouped), '[]'::jsonb) as groups,
+      coalesce((select jsonb_agg(to_jsonb(site_grouped)
+        order by site_grouped."updatedAt" desc, site_grouped."siteId", site_grouped."channelId")
+        from site_grouped), '[]'::jsonb) as sites
   `,
   );
   const result = rows[0];
+  const iso = (value: string | null) => (value ? new Date(value).toISOString() : null);
+  const sites = result?.sites ?? [];
   return {
     needsYouCount: Number(result?.needsYouCount ?? 0),
     groups: (result?.groups ?? []).map((group) => ({
       ...group,
-      attentionSince: group.attentionSince ? new Date(group.attentionSince).toISOString() : null,
+      attentionSince: iso(group.attentionSince),
     })),
+    sites: sites.slice(0, SITE_CONVERSATION_GROUP_LIMIT).map((site) => ({
+      ...site,
+      updatedAt: iso(site.updatedAt)!,
+      createdAt: iso(site.createdAt)!,
+      attentionSince: iso(site.attentionSince),
+    })),
+    sitesTruncated: sites.length > SITE_CONVERSATION_GROUP_LIMIT,
   };
 }
 
+/**
+ * Bound on Site rows per read. Rows sort by activity, so Sites nobody touched
+ * for a long time fall past it; the Artifacts page lists every Site.
+ */
+export const SITE_CONVERSATION_GROUP_LIMIT = 200;
+
 function sessionFilters(
   options: Pick<
     ListSessionsForSubjectOptions,
@@ -33225,6 +33431,7 @@ function sessionFilters(
     | "channelId"
     | "originSiteId"
     | "siteAccessId"
+    | "siteConversations"
     | "createdBy"
     | "updatedFrom"
     | "updatedBefore"
@@ -33258,9 +33465,14 @@ function sessionFilters(
       eq(schema.sessions.siteId, options.originSiteId),
       sql`${schema.sessions.siteAccessRootId} is not null`,
     );
-  } else {
+  } else if (
+    options.siteConversations !== "include" ||
+    options.authorizationScope?.agentAccessViewer
+  ) {
     // App-internal execution is not ordinary workspace conversation discovery.
     // This is presentation scope only: native ownership and Site RLS still apply.
+    // The console rail opts in explicitly (`include` or `group`); agent
+    // callers keep their own-root bound so the option never widens discovery.
     const ownRoot = options.authorizationScope?.agentAccessViewer?.callerRootSessionId;
     filters.push(
       ownRoot
@@ -33511,6 +33723,7 @@ function sessionListFilterIdentity(options: SessionListFilterOptions): string {
     !hasChannel &&
     !options.originSiteId &&
     !options.siteAccessId &&
+    options.siteConversations !== "include" &&
     !options.createdBy &&
     !options.updatedFrom &&
     !options.updatedBefore &&
@@ -33526,6 +33739,8 @@ function sessionListFilterIdentity(options: SessionListFilterOptions): string {
   return JSON.stringify([
     ...(options.siteAccessId ? [["siteAccess", options.siteAccessId]] : []),
     ...(options.originSiteId ? [["originSite", options.originSiteId]] : []),
+    // `group` returns the same rows as the default; only `include` changes them.
+    ...(options.siteConversations === "include" ? [["siteConversations", "include"]] : []),
     hasChannel ? ["channel", options.channelId] : null,
     options.createdBy ? ["creator", options.createdBy.kind, options.createdBy.subjectId] : null,
     options.updatedFrom ? ["updatedFrom", options.updatedFrom.toISOString()] : null,
@@ -33883,7 +34098,27 @@ export async function listVisibleSessionInvalidationIds(
   sessionIds: string[],
   authority: SessionListReadAuthority,
 ): Promise<string[]> {
-  if (!sessionIds.length) return [];
+  return (await listVisibleSessionInvalidationHints(db, workspaceId, sessionIds, authority))
+    .sessionIds;
+}
+
+/**
+ * Ordinary IDs plus, separately, the viewer's own visible Site conversations.
+ * A rail with Site rows refreshes their summaries for the latter without
+ * treating every unknown Site conversation as a full list invalidation.
+ */
+export async function listVisibleSessionInvalidationHints(
+  db: Database,
+  workspaceId: string,
+  sessionIds: string[],
+  authority: SessionListReadAuthority,
+): Promise<{ sessionIds: string[]; siteSessionIds: string[] }> {
+  if (!sessionIds.length) return { sessionIds: [], siteSessionIds: [] };
+  // Exactly the rows ordinary discovery omits (an agent keeps its own root).
+  const ownRoot = authority.authorizationScope?.agentAccessViewer?.callerRootSessionId;
+  const siteOnly = ownRoot
+    ? sql<boolean>`(${schema.sessions.siteAccessRootId} is not null and ${schema.sessions.rootSessionId} is distinct from ${ownRoot}::uuid)`
+    : sql<boolean>`${schema.sessions.siteAccessRootId} is not null`;
   return await withWorkspaceSubjectRls(
     db,
     workspaceId,
@@ -33891,16 +34126,24 @@ export async function listVisibleSessionInvalidationIds(
     async (tx) => {
       await requireSessionListReadAuthorityInScope(tx, workspaceId, authority);
       const rows = await tx
-        .select({ id: schema.sessions.id })
+        .select({
+          id: schema.sessions.id,
+          site: siteOnly,
+        })
         .from(schema.sessions)
         .where(
           and(
             eq(schema.sessions.workspaceId, workspaceId),
             inArray(schema.sessions.id, sessionIds),
-            ...sessionFilters({ ...authority, archiveStatus: "all" }),
+            // Hints carry no content. Site conversations use the same viewer
+            // authorization (and agent bound) as `siteConversations=include`.
+            ...sessionFilters({ ...authority, archiveStatus: "all", siteConversations: "include" }),
           ),
         );
-      return rows.map((row) => row.id);
+      return {
+        sessionIds: rows.filter((row) => !row.site).map((row) => row.id),
+        siteSessionIds: rows.filter((row) => row.site).map((row) => row.id),
+      };
     },
     { isolationLevel: "read committed" },
   );
@@ -33931,16 +34174,43 @@ async function readSessionListForSubject(
         }
         if (options.includeTotals && options.parentSessionId !== null && !options.pinsOnly)
           throw new SessionListCursorError("Attention totals require root or global pin pages");
-        const totals = options.includeTotals
-          ? await sessionListTotalsInScope(
-              tx,
-              workspaceId,
-              options.pinsOnly
-                ? { ...options, archiveStatus: "active", parentSessionId: null }
-                : options,
-            )
-          : undefined;
+        const groupSites = options.siteConversations === "group";
+        if (
+          groupSites &&
+          (options.parentSessionId !== null ||
+            options.pinsOnly ||
+            archiveMode === "archived" ||
+            options.originSiteId ||
+            options.siteAccessId)
+        )
+          throw new SessionListCursorError("Site rows require an ordinary, non-archived root page");
+        // Site rows are a complete section like pins: read once, with page one.
+        const siteGroupsRequested = groupSites && !options.cursor;
+        const completeTotals =
+          options.includeTotals || siteGroupsRequested
+            ? await sessionListTotalsInScope(
+                tx,
+                workspaceId,
+                options.pinsOnly
+                  ? { ...options, archiveStatus: "active", parentSessionId: null }
+                  : options,
+                siteGroupsRequested,
+              )
+            : undefined;
+        const totals =
+          options.includeTotals && completeTotals
+            ? { needsYouCount: completeTotals.needsYouCount, groups: completeTotals.groups }
+            : undefined;
+        const siteGroups = siteGroupsRequested ? (completeTotals?.sites ?? []) : undefined;
+        const siteGroupsTruncated = siteGroupsRequested && completeTotals?.sitesTruncated === true;
         const filters = [eq(schema.sessions.workspaceId, workspaceId), ...sessionFilters(options)];
+        // A pinned Site conversation is a personal shortcut like any other pin.
+        const pinnedFilters = groupSites
+          ? [
+              eq(schema.sessions.workspaceId, workspaceId),
+              ...sessionFilters({ ...options, siteConversations: "include" }),
+            ]
+          : filters;
         const ordinaryPinFilter =
           archiveMode === "archived"
             ? sql`true`
@@ -34270,7 +34540,7 @@ async function readSessionListForSubject(
                     eq(schema.sessionPins.workspaceId, workspaceId),
                     eq(schema.sessionPins.subjectId, options.subjectId),
                     eq(schema.sessionPins.pinned, true),
-                    ...filters,
+                    ...pinnedFilters,
                   ),
                 )
                 .orderBy(desc(schema.sessionPins.pinnedAt), desc(schema.sessions.id))
@@ -34403,6 +34673,9 @@ async function readSessionListForSubject(
             ...(options.needsYouOnly ? { needsYouOnly: true as const } : {}),
             ...(options.contentArchivedOnly ? { contentArchivedOnly: true as const } : {}),
             ...(options.mineOnly ? { mineOnly: true as const } : {}),
+            ...(options.siteConversations ? { siteConversations: options.siteConversations } : {}),
+            ...(siteGroups ? { siteGroups } : {}),
+            ...(siteGroupsTruncated ? { siteGroupsTruncated: true } : {}),
             pinned: pinnedRows.map((row) => sessionListEntry(mapListSession(row))),
             pinnedTruncated,
             sessions: pageRows.map((row) => sessionListEntry(mapListSession(row))),
@@ -34415,6 +34688,9 @@ async function readSessionListForSubject(
           ...(options.needsYouOnly ? { needsYouOnly: true as const } : {}),
           ...(options.contentArchivedOnly ? { contentArchivedOnly: true as const } : {}),
           ...(options.mineOnly ? { mineOnly: true as const } : {}),
+          ...(options.siteConversations ? { siteConversations: options.siteConversations } : {}),
+          ...(siteGroups ? { siteGroups } : {}),
+          ...(siteGroupsTruncated ? { siteGroupsTruncated: true } : {}),
           pinned: pinnedRows.map(mapListSession),
           pinnedTruncated,
           sessions: pageRows.map(mapListSession),
@@ -40878,7 +41154,7 @@ const DURABLE_TOOL_CALL_SCAN_PAGE = 32;
  * calls still read the whole turn before staying pending.
  */
 async function durableToolCallPairIdsTx(
-  tx: Pick<Database, "select">,
+  tx: Pick<Database, "execute">,
   scope: { workspaceId: string; sessionId: string; turnId: string },
   pending: Array<{ id: string; callId: string; callType: string }>,
 ): Promise<string[]> {
@@ -40892,32 +41168,16 @@ async function durableToolCallPairIdsTx(
   const durable: string[] = [];
   let before: number | null = null;
   while (unproven.size > 0) {
-    const page = await tx
-      .select({
-        position: schema.sessionHistoryItems.position,
-        item: schema.sessionHistoryItems.item,
-        itemCodecVersion: schema.sessionHistoryItems.itemCodecVersion,
-      })
-      .from(schema.sessionHistoryItems)
-      .where(
-        and(
-          eq(schema.sessionHistoryItems.workspaceId, scope.workspaceId),
-          eq(schema.sessionHistoryItems.sessionId, scope.sessionId),
-          eq(schema.sessionHistoryItems.turnId, scope.turnId),
-          before === null ? undefined : lt(schema.sessionHistoryItems.position, before),
-        ),
-      )
-      .orderBy(desc(schema.sessionHistoryItems.position))
-      .limit(DURABLE_TOOL_CALL_SCAN_PAGE);
+    const page = await readSessionHistoryToolIdentityPage(
+      tx,
+      scope,
+      before,
+      DURABLE_TOOL_CALL_SCAN_PAGE,
+    );
     // Positions are unique per session, so each row is strictly older than
     // every row already seen.
     for (const row of page) {
-      const item = fromPostgresLosslessJson(row.item, row.itemCodecVersion) as Record<
-        string,
-        unknown
-      >;
-      const callId = historyCallId(item);
-      const type = historyItemType(item);
+      const { callId, type } = row;
       if (callId === null || type === null) continue;
       const call = unproven.get(callId);
       if (!call) continue;

package/src/runtime-posture.ts

@@ -1974,6 +1974,7 @@ export const FORCE_RLS_TABLES = [
   "site_hostname_holds",
   "site_hostnames",
   "site_limit_profiles",
+  "site_opens",
   "site_platform_brake",
   "site_platform_storage",
   "site_platform_totals",
@@ -2276,6 +2277,7 @@ export const RUNTIME_FULL_DML_TABLES = [
   "site_data_workspace_validation_windows",
   "site_hostnames",
   "site_limit_profiles",
+  "site_opens",
   "site_platform_brake",
   "site_platform_storage",
   "site_platform_totals",

package/src/schema.ts

@@ -316,6 +316,30 @@ export const siteSessionAccess = pgTable(
   ],
 );
 
+/** When each person last opened a Site (migration 0908); personal ordering only. */
+export const siteOpens = pgTable(
+  "site_opens",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    siteId: uuid("site_id").notNull(),
+    openedAt: timestamp("opened_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.workspaceId, table.subjectId, table.siteId] }),
+    foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    foreignKey({
+      columns: [table.workspaceId, table.siteId],
+      foreignColumns: [workspaceArtifacts.workspaceId, workspaceArtifacts.id],
+    }).onDelete("cascade"),
+    index("site_opens_site_idx").on(table.workspaceId, table.siteId),
+  ],
+);
+
 export const workspaceArtifactUploads = pgTable(
   "workspace_artifact_uploads",
   {