@opengeni/db 5.0.1 → 6.0.0

package/src/session-message-search.ts

@@ -0,0 +1,348 @@
+import { createHash } from "node:crypto";
+import { and, asc, eq, sql, type SQL } from "drizzle-orm";
+import { z } from "zod";
+import type {
+  SessionMessageSearchRequest,
+  SessionMessageSearchMatch,
+  SessionMessageSearchResponse,
+} from "@opengeni/contracts";
+import type { Database } from "./database";
+import * as schema from "./schema";
+import { readSessionMessageSliceInScope } from "./session-event-slices";
+import { fromPostgresLosslessJson, LOSSLESS_JSON_STRING_PREFIX } from "./lossless-json";
+
+const Position = z
+  .object({
+    sessionId: z.string().uuid(),
+    sequence: z.number().int().min(1).max(2_147_483_647),
+    offset: z.number().int().min(0).max(2_147_483_647),
+    utf16Offset: z.number().int().min(0).max(4_294_967_294),
+    minimumMatchOffset: z.number().int().min(0).max(4_294_967_294),
+    matched: z.boolean(),
+    done: z.boolean(),
+    skipSession: z.boolean().optional(),
+  })
+  .strict();
+const Cursor = z
+  .object({
+    version: z.literal(1),
+    binding: z.string().regex(/^[a-f0-9]{64}$/),
+    position: Position,
+    scanned: z.number().int().nonnegative().safe(),
+    matched: z.number().int().nonnegative().safe(),
+    occurrences: z.number().int().nonnegative().safe(),
+  })
+  .strict();
+type Position = z.infer<typeof Position>;
+
+export class SessionMessageSearchCursorError extends Error {
+  constructor() {
+    super("Invalid session message search cursor or changed search scope");
+  }
+}
+
+/** ECMAScript Unicode simple case folding, not locale-sensitive lowercasing.
+ * Escaping every regexp metacharacter makes %, _, backslash, etc. literal too.
+ * RegExp indices refer to original UTF-16 text (no lowercased-offset drift).
+ */
+export function sessionMessageLiteralPattern(query: string): RegExp {
+  return new RegExp(query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "iu");
+}
+
+export function sessionMessageSearchSnippet(text: string, start: number, length: number) {
+  let left = Math.max(0, start - 120);
+  let right = Math.min(text.length, start + length + 120);
+  if (left > 0 && /[\uDC00-\uDFFF]/.test(text[left]!)) left--;
+  if (right < text.length && /[\uDC00-\uDFFF]/.test(text[right]!)) right++;
+  return {
+    text: text.slice(left, right),
+    matchStart: start - left,
+    matchEnd: start + length - left,
+  };
+}
+
+/** Internal executor: caller holds subject RLS, session-tenancy and membership
+ * fences and supplies the ordinary session list filters. Never call as auth.
+ * Work/transfer is bounded by 32 scalar windows per request. No history cutoff:
+ * an unfinished scan ALWAYS returns an advancing cursor, even with zero hits.
+ */
+export async function scanSessionMessages(
+  db: Database,
+  workspaceId: string,
+  request: SessionMessageSearchRequest,
+  filters: SQL[],
+  authorityIdentity: unknown,
+  signal?: AbortSignal,
+): Promise<SessionMessageSearchResponse> {
+  signal?.throwIfAborted();
+  const started = performance.now();
+  const binding = createHash("sha256")
+    .update(
+      JSON.stringify([
+        workspaceId,
+        authorityIdentity,
+        request.query,
+        request.sessionId ?? null,
+        request.archiveStatus ?? "active",
+        ...(request.groupBy ? [{ groupBy: request.groupBy }] : []),
+      ]),
+    )
+    .digest("hex");
+  let position: Position | null = null;
+  let scanned = 0;
+  let matched = 0;
+  let occurrences = 0;
+  if (request.cursor) {
+    try {
+      const cursor = Cursor.parse(
+        JSON.parse(Buffer.from(request.cursor, "base64url").toString("utf8")),
+      );
+      if (
+        cursor.binding !== binding ||
+        cursor.matched > cursor.scanned ||
+        cursor.matched > cursor.occurrences ||
+        (cursor.position.skipSession &&
+          (request.groupBy !== "session" || !cursor.position.done || !cursor.position.matched))
+      )
+        throw new Error();
+      position = cursor.position;
+      scanned = cursor.scanned;
+      matched = cursor.matched;
+      occurrences = cursor.occurrences;
+    } catch {
+      throw new SessionMessageSearchCursorError();
+    }
+  }
+  const pattern = new RegExp(sessionMessageLiteralPattern(request.query), "giu");
+  const matches: SessionMessageSearchMatch[] = [];
+  let exhausted = false;
+  const e = schema.sessionEvents;
+  // One bounded batch for ordinary complete messages. Large scalar continuations
+  // alone use the existing lossless slice reader. There is no per-message SQL
+  // round trip for the common small-message/no-hit path.
+  {
+    const boundary = position
+      ? position.skipSession
+        ? sql`${e.sessionId} > ${position.sessionId}::uuid`
+        : sql`(${e.sessionId} > ${position.sessionId}::uuid or (${e.sessionId} = ${position.sessionId}::uuid and ${position.done ? sql`${e.sequence} > ${position.sequence}` : sql`${e.sequence} >= ${position.sequence}`}))`
+      : sql`true`;
+    // Correlate the exact durable message identity, not turn status or latest
+    // model context. The latest full completion for a provider message wins,
+    // so an earlier shorter completion cannot hide later retained text. Same-
+    // text distinct provider messages remain distinct; the id-less final
+    // settlement copy is suppressed against its earlier complete text.
+    // Suppression requires the competing copy to retain searchable string text
+    // itself: a later text-less completion (failed/empty retry sharing the
+    // provider message id) must never hide the earlier complete text.
+    const identities = await db
+      .select({
+        sessionId: e.sessionId,
+        eventId: e.id,
+        sequence: e.sequence,
+        turnId: e.turnId,
+        type: sql<"user.message" | "agent.message.completed">`${e.type}`,
+        sessionTitle: sql<
+          string | null
+        >`case when octet_length(${schema.sessions.title}) <= 2048 then ${schema.sessions.title} else null end`,
+        messageId: sql<unknown>`case when octet_length((${e.payload}->'messageId')::text) <= 2048 then ${e.payload}->'messageId' else null end`,
+        codec: e.payloadCodecVersion,
+        smallText: sql<unknown>`case when octet_length(${e.payload}->>'text') <= 8192 then ${e.payload}->'text' else null end`,
+      })
+      .from(e)
+      .innerJoin(
+        schema.sessions,
+        and(eq(schema.sessions.workspaceId, e.workspaceId), eq(schema.sessions.id, e.sessionId)),
+      )
+      .where(
+        and(
+          eq(e.workspaceId, workspaceId),
+          ...filters,
+          boundary,
+          request.sessionId ? eq(e.sessionId, request.sessionId) : sql`true`,
+          sql`${e.type} in ('user.message', 'agent.message.completed')`,
+          sql`(${e.turnAssociation} is null or ${e.turnAssociation} = 'current')`,
+          sql`${e.duplicateOfEventId} is null`,
+          sql`jsonb_typeof(${e.payload}->'text') = 'string'`,
+          sql`(${e.type} <> 'user.message' or not exists (
+        select 1 from ${schema.sessionTurns} unclaimed
+        where unclaimed.workspace_id = ${workspaceId} and unclaimed.session_id = ${e.sessionId}
+          and unclaimed.trigger_event_id = ${e.id} and unclaimed.source in ('user', 'api')
+          and unclaimed.started_at is null))`,
+          sql`(${e.type} <> 'agent.message.completed' or not exists (
+        select 1 from ${schema.sessionEvents} other_message
+        where other_message.workspace_id = ${workspaceId} and other_message.session_id = ${e.sessionId}
+          and other_message.turn_id = ${e.turnId}
+          and other_message.type = 'agent.message.completed' and other_message.duplicate_of_event_id is null
+          and (other_message.turn_association is null or other_message.turn_association = 'current')
+          and jsonb_typeof(other_message.payload->'text') = 'string'
+          and ((jsonb_typeof(${e.payload}->'messageId') = 'string'
+              and other_message.sequence > ${e.sequence}
+              and other_message.payload->'messageId' = ${e.payload}->'messageId'
+              and (other_message.payload_codec_version is not distinct from ${e.payloadCodecVersion}
+                or left(${e.payload}->>'messageId', ${LOSSLESS_JSON_STRING_PREFIX.length}) <> ${LOSSLESS_JSON_STRING_PREFIX}))
+            or (coalesce(${e.payload}->>'messageId', '') = ''
+              and other_message.sequence < ${e.sequence}
+              and other_message.payload->'text' = ${e.payload}->'text'
+              and (other_message.payload_codec_version is not distinct from ${e.payloadCodecVersion}
+                or left(${e.payload}->>'text', ${LOSSLESS_JSON_STRING_PREFIX.length}) <> ${LOSSLESS_JSON_STRING_PREFIX})))))`,
+        ),
+      )
+      .orderBy(asc(e.sessionId), asc(e.sequence))
+      .limit(33);
+    let identityIndex = 0;
+    for (let window = 0; window < 32 && matches.length < (request.limit ?? 20); window++) {
+      signal?.throwIfAborted();
+      if (window > 0 && performance.now() - started >= 1_500) break;
+      const identity = identities[identityIndex];
+      if (!identity) {
+        // Grouping can drain a full candidate batch in fewer than 32 windows.
+        // A full batch is not proof that later sessions do not exist.
+        exhausted = identities.length < 33;
+        break;
+      }
+      const continuing =
+        position &&
+        !position.done &&
+        position.sessionId === identity.sessionId &&
+        position.sequence === identity.sequence;
+      if (!continuing) {
+        scanned++;
+        position = {
+          sessionId: identity.sessionId,
+          sequence: identity.sequence,
+          offset: 0,
+          utf16Offset: 0,
+          minimumMatchOffset: 0,
+          matched: false,
+          done: false,
+        };
+      }
+      const offset = position!.offset;
+      const utf16Offset = position!.utf16Offset;
+      const smallText = fromPostgresLosslessJson(identity.smallText, identity.codec);
+      // Amortize full-source detoasting/codec validation over adjacent windows,
+      // not a larger request budget. A four-window read consumes four of the
+      // original 32 slots, even if a match/short source ends it early.
+      const scalarWindows = typeof smallText === "string" ? 1 : Math.min(4, 32 - window);
+      const slice =
+        typeof smallText === "string"
+          ? {
+              offset: 0,
+              total: smallText.length,
+              unit: "utf16" as const,
+              text: smallText,
+              omitted: false,
+            }
+          : await readSessionMessageSliceInScope(
+              db,
+              workspaceId,
+              identity.sessionId,
+              {
+                id: identity.eventId,
+                sequence: identity.sequence,
+                type: identity.type,
+                turnId: identity.turnId,
+                turnAssociation: null,
+                duplicateOfEventId: null,
+              },
+              offset,
+              scalarWindows,
+            );
+      window += scalarWindows - 1;
+      if (!slice || slice.omitted) {
+        // Deletion/visibility changes never turn into a fabricated message.
+        position = { ...position!, done: true };
+        identityIndex++;
+        continue;
+      }
+      pattern.lastIndex = Math.max(0, position!.minimumMatchOffset - utf16Offset);
+      let found: RegExpExecArray | null;
+      const messageId = fromPostgresLosslessJson(identity.messageId, identity.codec);
+      while (matches.length < (request.limit ?? 20) && (found = pattern.exec(slice.text))) {
+        matches.push({
+          sessionId: identity.sessionId,
+          sessionTitle: identity.sessionTitle,
+          eventId: identity.eventId,
+          sequence: identity.sequence,
+          turnId: identity.turnId,
+          role: identity.type === "user.message" ? "user" : "assistant",
+          messageId: typeof messageId === "string" ? messageId : null,
+          messageMatchOffset: utf16Offset + found.index,
+          snippet: sessionMessageSearchSnippet(slice.text, found.index, found[0].length),
+        });
+        if (!position!.matched) matched++;
+        occurrences++;
+        position = {
+          ...position!,
+          matched: true,
+          minimumMatchOffset: utf16Offset + found.index + found[0].length,
+        };
+        if (request.groupBy === "session") {
+          position = { ...position, done: true, skipSession: true };
+          break;
+        }
+      }
+      if (position!.skipSession) {
+        // Skip both buffered messages and all unbuffered history of this
+        // matching session. The next cursor carries a strict session boundary,
+        // so a prolific message cannot flood the workspace picker with pages.
+        do {
+          identityIndex++;
+        } while (identities[identityIndex]?.sessionId === identity.sessionId);
+        continue;
+      }
+      const units = slice.unit === "utf16" ? slice.text.length : Array.from(slice.text).length;
+      if (matches.length >= (request.limit ?? 20)) {
+        if (
+          offset + units >= slice.total &&
+          position!.minimumMatchOffset >= utf16Offset + slice.text.length
+        ) {
+          position = { ...position!, done: true };
+          identityIndex++;
+        }
+        break;
+      }
+      if (offset + units >= slice.total) {
+        position = { ...position!, done: true };
+        identityIndex++;
+        continue;
+      }
+      // Overlap enough complete scalars for every literal crossing a window.
+      // Retain additional preceding snippet context; resume offset is absolute
+      // UTF-16 so supplementary characters and lossless code units cannot drift.
+      const overlap = request.query.length * 2 + 122;
+      let advance = Math.max(1, units - overlap);
+      let prefix =
+        slice.unit === "utf16"
+          ? slice.text.slice(0, advance)
+          : Array.from(slice.text).slice(0, advance).join("");
+      if (slice.unit === "utf16" && /[\uD800-\uDBFF]/.test(prefix.at(-1)!)) {
+        advance--;
+        prefix = prefix.slice(0, -1);
+      }
+      position = {
+        ...position!,
+        offset: offset + advance,
+        utf16Offset: utf16Offset + prefix.length,
+        minimumMatchOffset: Math.max(position!.minimumMatchOffset, utf16Offset + prefix.length),
+        done: false,
+      };
+    }
+    if (identityIndex >= identities.length && identities.length < 33) exhausted = true;
+  }
+  signal?.throwIfAborted();
+  return {
+    matches,
+    hasMore: !exhausted,
+    countIsExact: exhausted,
+    scannedMessages: scanned,
+    matchedMessageCount: matched,
+    matchedOccurrenceCount: occurrences,
+    nextCursor:
+      exhausted || !position
+        ? null
+        : Buffer.from(
+            JSON.stringify({ version: 1, binding, position, scanned, matched, occurrences }),
+          ).toString("base64url"),
+  };
+}

package/src/session-queue-commands.ts

@@ -1,4 +1,6 @@
+import { acceptSessionFileAttachments } from "./session-file-attachments";
 import { withLatestStartedSessionPolicy } from "./session-execution-policy";
+import { parseAcceptedMcpAccountBindings } from "./mcp-account-bindings";
 import {
   WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1,
   XaiProviderAccountAuthoritySnapshotV1,
@@ -14,6 +16,7 @@ import {
   stableJson,
   turnExecutionPolicyAuditMetadata,
   type McpPersonalConnectionDelegation,
+  type McpConnectionAccountBinding,
   type DraftTimelineAnnotation,
   type LatencyMode,
   type ReasoningEffort,
@@ -31,7 +34,12 @@ import {
   type PersonalResourceAttachmentIntent,
 } from "@opengeni/contracts";
 import { and, asc, desc, eq, inArray, sql } from "drizzle-orm";
-import { setSubjectRlsContext, type Database, type SessionActivityDatabase } from "./database";
+import {
+  withSessionRlsActorContext,
+  setSubjectRlsContext,
+  type Database,
+  type SessionActivityDatabase,
+} from "./database";
 import {
   fromPostgresLosslessJson,
   fromPostgresLosslessText,
@@ -347,14 +355,15 @@ async function personalConnectionDelegationsForAgentActor(
   db: Database,
   workspaceId: string,
   actor: Extract<SessionCommandActor, { type: "agent_attempt" }>,
-  targetSessionId: string,
 ): Promise<{
   delegations: McpPersonalConnectionDelegation[];
+  mcpAccountBindings: McpConnectionAccountBinding[] | null;
   connectionAuthoritySubjectId: string | null;
 }> {
   const [row] = await db
     .select({
       delegations: schema.sessionTurns.personalConnectionDelegations,
+      mcpAccountBindings: schema.sessionTurns.mcpAccountBindings,
       initiatingHumanSubjectId: schema.sessionTurns.initiatingHumanSubjectId,
     })
     .from(schema.sessionTurns)
@@ -377,22 +386,11 @@ async function personalConnectionDelegationsForAgentActor(
       `Agent authority turn has malformed personal MCP delegation state: ${actor.sessionId}/${actor.turnId}`,
     );
   }
-  // Agent messages and Agent Steer create new accepted work. A once grant is
-  // already bound to the caller turn, while a session grant may be projected
-  // only into another turn of that exact session. Always grants can cross the
-  // direct parent/child boundary subject to the live admission fences.
-  const delegations = parsed.data
-    .filter((delegation) => {
-      const authority = delegation.userDelegation;
-      if (!authority) return true;
-      if (authority.mode === "once") return false;
-      if (authority.mode === "session") return authority.sessionId === targetSessionId;
-      return true;
-    })
-    .map((delegation) => ({ ...delegation }));
-  const activated = delegations.filter((delegation) => delegation.userDelegation);
-  if (activated.length === 0) {
-    return { delegations, connectionAuthoritySubjectId: null };
+  // New agent work inherits the exact originating turn's sender and accounts.
+  const delegations = parsed.data.map((delegation) => ({ ...delegation }));
+  const mcpAccountBindings = parseAcceptedMcpAccountBindings(row.mcpAccountBindings);
+  if (delegations.length === 0) {
+    return { delegations, mcpAccountBindings, connectionAuthoritySubjectId: null };
   }
   const connectionAuthoritySubjectId = row.initiatingHumanSubjectId;
   if (!connectionAuthoritySubjectId) {
@@ -400,14 +398,14 @@ async function personalConnectionDelegationsForAgentActor(
       `Agent authority turn lost its causal human: ${actor.sessionId}/${actor.turnId}`,
     );
   }
-  for (const delegation of activated) {
+  for (const delegation of delegations) {
     if (delegation.ownerSubjectId !== connectionAuthoritySubjectId) {
       throw new SessionControlInvariantError(
         `Agent authority turn causal human does not own retained connection authority: ${actor.sessionId}/${actor.turnId}`,
       );
     }
   }
-  return { delegations, connectionAuthoritySubjectId };
+  return { delegations, mcpAccountBindings, connectionAuthoritySubjectId };
 }
 
 async function xaiAuthorityForAgentActor(
@@ -1759,6 +1757,7 @@ export async function submitHumanPromptInTransaction(
     /** Record the admitted run's durable usage fact in this transaction. */
     recordAgentRunUsage?: boolean;
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    mcpAccountBindings?: McpConnectionAccountBinding[] | null;
     personalResourceAttachment?: PersonalResourceAttachmentIntent;
     mcpCredentialUpdates?: Array<{
       id: string;
@@ -1769,11 +1768,7 @@ export async function submitHumanPromptInTransaction(
     beforeFreshPromptCommit?: (tx: Database) => Promise<void>;
     /** Backend-only authority capture, atomic with the newly accepted turn. */
     captureTurnAuthority?: (tx: Database, turnId: string) => Promise<void>;
-    selectedHostMcpDelegations?: Array<{
-      serverId: string;
-      delegationId: string;
-      generation: number;
-    }>;
+
     /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
     controlLockTimeoutMs?: number;
   },
@@ -1829,10 +1824,9 @@ export async function submitHumanPromptInTransaction(
     mirrorToRealtime: input.mirrorToRealtime ?? true,
     mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
     personalConnectionDelegations: input.personalConnectionDelegations ?? [],
+    mcpAccountBindings: input.mcpAccountBindings ?? null,
     personalResourceAttachment: input.personalResourceAttachment ?? null,
-    ...(input.selectedHostMcpDelegations?.length
-      ? { selectedHostMcpDelegations: input.selectedHostMcpDelegations }
-      : {}),
+
     ...(input.actor.type === "service"
       ? {
           serviceInitiator: {
@@ -1923,6 +1917,7 @@ export async function submitHumanPromptInTransaction(
     !isQueueEditSubmission &&
     before.state === "active" &&
     session.status === "requires_action" &&
+    !session.admissionBlock &&
     session.activeTurnId !== null
       ? "steer"
       : input.delivery;
@@ -2082,9 +2077,7 @@ export async function submitHumanPromptInTransaction(
     : (frozenInitiator.initiatingHumanSubjectId ??
       (frozenInitiator.initiator.kind === "subject" ? frozenInitiator.initiator.subjectId : null));
   if (
-    (input.personalConnectionDelegations ?? []).some(
-      (delegation) => delegation.userDelegation !== undefined,
-    ) ||
+    (input.personalConnectionDelegations ?? []).length > 0 ||
     input.personalResourceAttachment !== undefined
   ) {
     if (!acceptedInitiatingHumanSubjectId) {
@@ -2194,6 +2187,9 @@ export async function submitHumanPromptInTransaction(
           personalConnectionDelegations: editedSourceTurn
             ? editedSourceTurn.personalConnectionDelegations
             : (input.personalConnectionDelegations ?? []),
+          mcpAccountBindings: editedSourceTurn
+            ? editedSourceTurn.mcpAccountBindings
+            : parseAcceptedMcpAccountBindings(input.mcpAccountBindings),
           xaiProviderAccountAuthoritySnapshot,
           createdAt: now,
           updatedAt: now,
@@ -2398,7 +2394,9 @@ export async function submitHumanPromptInTransaction(
   );
   const noCurrentAfter =
     effectiveDelivery === "steer" ? liveCurrentTurnId === null : !session.activeTurnId;
-  const nextStatus = noCurrentAfter ? "queued" : session.status;
+  const nextStatus = noCurrentAfter
+    ? "queued"
+    : (session.admissionBlock?.previousStatus ?? session.status);
   if (nextStatus !== session.status) {
     eventValues.push({
       accountId: input.accountId,
@@ -2414,6 +2412,24 @@ export async function submitHumanPromptInTransaction(
     .insert(schema.sessionEvents)
     .values(withLosslessContentWriteVersion(eventValues, "payload", "payloadCodecVersion"))
     .returning();
+  // Shared acceptance boundary covers ordinary Send/Steer and realtime. Only the
+  // verified human command can share original uploads; inherited agent identity
+  // is deliberately insufficient. Events must exist before grant provenance is checked.
+  if (input.actor.type === "human" && input.actor.subjectId === input.subjectId) {
+    await withSessionRlsActorContext(
+      { subjectId: input.subjectId, privateFileOwnerSubjectId: input.subjectId },
+      () =>
+        acceptSessionFileAttachments(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sessionId: input.sessionId,
+          turnId: turn.id,
+          subjectId: input.subjectId,
+          resources: [...ResourceRef.array().parse(session.resources), ...input.resources],
+        }),
+    );
+  }
+
   if (input.actor.type === "human" && input.mirrorToRealtime !== false) {
     await mirrorSessionRealtimeContextInTransaction(db, {
       accountId: input.accountId,
@@ -2445,6 +2461,7 @@ export async function submitHumanPromptInTransaction(
       tools: session.tools,
       activeTurnId: effectiveDelivery === "steer" ? liveCurrentTurnId : session.activeTurnId,
       status: nextStatus,
+      admissionBlock: null,
       queueVersion,
       queueHeadPosition: 0,
       queueTailPosition: ordered.length,
@@ -2647,7 +2664,6 @@ export async function sendAgentMessageInTransaction(
     db,
     input.workspaceId,
     input.actor,
-    input.targetSessionId,
   );
   const personalConnectionDelegations = inheritedConnectionAuthority.delegations;
   const xaiAuthority = await xaiAuthorityForAgentActor(db, input.workspaceId, input.actor);
@@ -2701,6 +2717,7 @@ export async function sendAgentMessageInTransaction(
               ...(xaiAuthority.subjectId ? { xaiAuthoritySubjectId: xaiAuthority.subjectId } : {}),
             },
             personalConnectionDelegations,
+            mcpAccountBindings: inheritedConnectionAuthority.mcpAccountBindings,
             xaiProviderAccountAuthoritySnapshot: xaiAuthority.snapshot,
             state: "pending",
           },
@@ -2760,7 +2777,11 @@ export async function sendAgentMessageInTransaction(
   }
   const eventIds = insertedEvents.map((event) => event.id);
   const workflowId = session.temporalWorkflowId ?? `session-${session.id}`;
-  const runnable = !realtimeActive && session.activeTurnId === null && effective.state === "active";
+  const runnable =
+    !session.admissionBlock &&
+    !realtimeActive &&
+    session.activeTurnId === null &&
+    effective.state === "active";
   const wake = runnable
     ? await registerInternalUpdateWakeInTransaction(db, {
         accountId: input.accountId,
@@ -2897,7 +2918,6 @@ export async function steerAgentSessionInTransaction(
     db,
     input.workspaceId,
     input.actor,
-    input.targetSessionId,
   );
   const personalConnectionDelegations = inheritedConnectionAuthority.delegations;
   const xaiAuthority = await xaiAuthorityForAgentActor(db, input.workspaceId, input.actor);
@@ -2986,6 +3006,7 @@ export async function steerAgentSessionInTransaction(
               ...(xaiAuthority.subjectId ? { xaiAuthoritySubjectId: xaiAuthority.subjectId } : {}),
             },
             personalConnectionDelegations,
+            mcpAccountBindings: inheritedConnectionAuthority.mcpAccountBindings,
             xaiProviderAccountAuthoritySnapshot: xaiAuthority.snapshot,
             state: "pending",
           },
@@ -3095,7 +3116,10 @@ export async function steerAgentSessionInTransaction(
     .update(schema.sessions)
     .set({
       activeTurnId: supersession.liveCurrentTurnId,
-      status: supersession.liveCurrentTurnId ? session.status : "queued",
+      status: supersession.liveCurrentTurnId
+        ? (session.admissionBlock?.previousStatus ?? session.status)
+        : "queued",
+      admissionBlock: null,
       lastSequence: sequence,
       updatedAt: now,
     })