feat(triggers): control created session access

[markokraemer]

Summary

• default trigger-created sessions to private access owned by the trigger agent service account
• support selected account members/groups or whole-project access in API, SDK, and trigger settings
• propagate policy changes to prior trigger-created sessions while preserving pinned-session sharing
• persist policy in PostgreSQL and serialize edits with session creation
• document the contract and add REST plus Playwright E2E coverage

Verification

• pnpm test -- --id TRG-14 — 1 passed, 0 failed
• pnpm test -- --browser-only — 13 passed, 7 skipped
• pnpm test — exit 0; SDK 2,093 passed; route coverage 566/578 with 12 allowlisted
• pnpm --filter kortix-api test — 6,946 passed, 74 skipped, 0 failed
• pnpm test -- --packages-only — exit 0 in 126.8s; SDK typecheck and packed-install smoke passed
• git diff --check — exit 0

Migration safety

• metadata-only column default
• bounded lock and statement timeouts
• new empty grants table
• NOT VALID constraint with separate validation migration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
suna	Ignored		Aug 16, 2026 10:49pm

[strix-security]

Strix Security Review

No security issues found.

_{Updated for 2a1ebee.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}