@opengeni/api-router 0.30.3 → 2.2.0-canary.0

package/src/routes/computer-sessions.ts

@@ -25,6 +25,7 @@ import {
   type SessionAuthorizationOperation,
 } from "@opengeni/contracts";
 import {
+  getSessionAuthorityEpoch,
   acquireLease,
   activateComputerSession,
   completeComputerSessionEnd,
@@ -36,7 +37,8 @@ import {
   findComputerSessionControlRecordByOperation,
   getAttachedBrowserDevice,
   getComputerSessionControlRecord,
-  getEnrollment,
+  getLiveEnrollmentConnection,
+  getSandbox,
   getSession,
   listComputerSessions,
   prepareComputerSessionCreate,
@@ -44,6 +46,7 @@ import {
   releaseLeaseHolder,
   readLease,
   recordLeaseControllerDataPlaneUrl,
+  terminalizeStaleConnectedInteractionPlacement,
   touchComputerSessionController,
   type ComputerSessionControlRecord,
   type LeaseSnapshot,
@@ -52,6 +55,7 @@ import {
   requireAccessGrant,
   requireSessionAuthorization,
   relayConfigFromSettings,
+  resolveSessionSandboxRuntime,
   SessionAuthorizationDeniedError,
   SessionAuthorizationUnavailableError,
   type ApiRouteDeps,
@@ -71,6 +75,7 @@ import {
   NatsControlRpc,
   NatsOpStreamTransport,
   provisionBrowserControlClient,
+  renewSandboxProviderExpiration,
   type BrowserControlPlacementSession,
 } from "@opengeni/runtime/sandbox";
 import type { Context, Hono } from "hono";
@@ -81,9 +86,21 @@ import {
   deriveComputerSessionControllerTokens,
   deriveComputerViewGrantToken,
 } from "../browser-controller-authority";
-import { withCachedController } from "../controller-data-plane";
+import { connectedMachineComputerAccessError } from "../connected-machine-computer-access";
+import {
+  controllerCacheAllowsHostFetch,
+  controllerCachedUrlIsUsable,
+  shouldPersistControllerDataPlaneUrl,
+  withCachedController,
+} from "../controller-data-plane";
 import { withInteractionHolderHeartbeat } from "../interaction-holder-heartbeat";
-import { allowedCorsOrigin } from "../http/cors";
+import { validateInteractionRequestOrigin } from "../http/cors";
+import { ApiHttpError } from "../http/api-error";
+import { interactionControlApiError } from "../http/interaction-control-error";
+import {
+  createInteractionFrameProxyAttachment,
+  placementUsesInteractionFrameProxy,
+} from "../interaction-frame-proxy";
 import { observeComputerActionResult, observeLifecycleResult } from "../interaction-metrics";
 import { withChannelA, withChannelARead, type ChannelAOperation } from "../sandbox/channel-a";
 
@@ -141,7 +158,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     const request = await parseJsonBody(context, CreateComputerSessionRequest);
     const startedAtMs = performance.now();
     await authorizeSourceSession(deps, grant, request.sessionId, "session.control");
-    const origin = requestOrigin(context, deps.settings.corsAllowOriginRegex);
+    const origin = requestOrigin(context, deps.settings);
     const authority = controllerAuthorityRoot(deps);
 
     try {
@@ -264,26 +281,27 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
               () => placement,
             );
           } catch (error) {
-            if (
+            const retryableRequestFailure =
+              error instanceof BrowserControlRequestError &&
+              error.retryable &&
+              error.error.code !== "machine_locked";
+            const outcomeUnknown =
+              error instanceof BrowserControlProtocolError ||
               error instanceof BrowserControlTransportError ||
-              (error instanceof BrowserControlRequestError &&
-                error.retryable &&
-                error.error.code !== "machine_locked") ||
-              isAbort(error)
-            ) {
-              throw error;
-            }
+              isAbort(error);
+            const rethrowAfterFailure =
+              error instanceof BrowserControlTransportError ||
+              retryableRequestFailure ||
+              isAbort(error);
             const failed = await failComputerSessionOperation(deps.db, {
               accountId: grant.accountId,
               workspaceId,
               operationId: request.operationId,
               computerSessionId: preparedSession.id,
-              ...(error instanceof BrowserControlProtocolError
-                ? { state: "outcome_unknown" as const }
-                : {}),
+              ...(outcomeUnknown ? { state: "outcome_unknown" as const } : {}),
               error: interactionFailure(error),
             });
-            if (interactionHeld && !(error instanceof BrowserControlProtocolError)) {
+            if (interactionHeld && !outcomeUnknown) {
               await releaseInteractionHolder(
                 grant,
                 workspaceId,
@@ -291,6 +309,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
                 placement.placement,
               ).catch(() => undefined);
             }
+            if (rethrowAfterFailure) throw error;
             return failed;
           }
           // These facts come from the physical adapter after its native helper
@@ -452,7 +471,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/attachments",
     async (context) => {
       const { workspaceId, grant, computerSessionId } = await routePreamble(context, "stream:view");
-      const origin = requestOrigin(context, deps.settings.corsAllowOriginRegex);
+      const origin = requestOrigin(context, deps.settings);
       const request = await parseJsonBody(context, ComputerSessionAttachmentRequest);
       const result = await withActiveComputerController(
         context,
@@ -463,25 +482,10 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         "computer.attach",
         async ({ client, sessionClient, record, binding, placement }) => {
           if (origin) await client.addAllowedOrigins([origin]);
-          const grantId = randomUUID();
-          const expiresAt = new Date(Date.now() + request.expiresInSeconds * 1_000).toISOString();
-          const token = deriveComputerViewGrantToken({
-            rootSecret: controllerAuthorityRoot(deps),
-            accountId: grant.accountId,
-            workspaceId,
-            placement: record.session.placement,
-            placementInstanceId: placement.placementInstanceId,
-            computerSessionId,
-            controllerGeneration: binding.controllerGeneration,
-            tokenGeneration: record.tokenGeneration,
-            grantId,
-            expiresAt,
-          });
           const reference = {
             computerSessionId,
             controllerGeneration: binding.controllerGeneration,
           };
-          await client.createComputerViewGrant(reference, { grantId, token, expiresAt });
           const target = (await sessionClient.listTargets()).find(
             (candidate) => candidate.id === request.targetId,
           );
@@ -492,6 +496,33 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
               retryable: false,
             });
           }
+          if (target.kind === "app") {
+            throw new BrowserControlRequestError(409, {
+              code: "unsupported",
+              message:
+                "application targets support semantic control but do not provide a visual stream; select a window or screen",
+              retryable: false,
+            });
+          }
+          const grantId = randomUUID();
+          const expiresAt = new Date(Date.now() + request.expiresInSeconds * 1_000).toISOString();
+          const token = deriveComputerViewGrantToken({
+            rootSecret: controllerAuthorityRoot(deps),
+            accountId: grant.accountId,
+            workspaceId,
+            placement: record.session.placement,
+            placementInstanceId: placement.placementInstanceId,
+            computerSessionId,
+            controllerGeneration: binding.controllerGeneration,
+            tokenGeneration: record.tokenGeneration,
+            grantId,
+            expiresAt,
+          });
+          await client.createComputerViewGrant(reference, {
+            grantId,
+            token,
+            expiresAt,
+          });
           const relaySecret = placement.session.openComputerFrames
             ? resolveStreamTokenSecret(deps.settings)
             : null;
@@ -510,15 +541,31 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
               ...(request.stream ? { stream: request.stream } : {}),
             });
           } catch (error) {
+            const publicFailure = interactionControlApiError(error, "computer");
             console.error("computer frame relay open failed", {
               computerSessionId,
               targetId: request.targetId,
-              failure: error instanceof Error ? error.message : String(error),
+              failureCode: publicFailure?.details?.controlFailureCode ?? "unclassified",
+              retryable: publicFailure?.retryable ?? false,
+              outcomeUnknown: publicFailure?.outcomeUnknown ?? false,
+              controlRequestId: publicFailure?.details?.controlRequestId ?? null,
             });
             throw error;
           }
           const stream = relayed
             ? await (async () => {
+                // 0281: stamp the authenticated viewer subject and the live
+                // session authority epoch into the relay stream token.
+                const relayAuthorityEpoch = await getSessionAuthorityEpoch(deps.db, {
+                  accountId: grant.accountId,
+                  workspaceId,
+                  sessionId: record.sourceSessionId,
+                });
+                if (relayAuthorityEpoch === null) {
+                  throw new BrowserControlUnsupportedError(
+                    "stream authority is unavailable for this session",
+                  );
+                }
                 const relayToken = await mintStreamToken(relaySecret!, {
                   workspaceId,
                   sessionId: record.sourceSessionId,
@@ -526,6 +573,8 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
                   leaseEpoch: record.tokenGeneration,
                   port: relayed.channel.port,
                   ttlSeconds: request.expiresInSeconds,
+                  subjectId: grant.subjectId,
+                  authorityEpoch: relayAuthorityEpoch,
                 });
                 return {
                   kind: "relay" as const,
@@ -540,30 +589,55 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
                   },
                 };
               })()
-            : record.session.placement.kind === "sandbox_group" &&
-                record.session.platform === "linux" &&
-                target.kind === "screen"
-              ? {
-                  kind: "direct_rfb" as const,
-                  url: await client.computerRfbStreamUrl(reference, request.targetId),
-                  protocols: [
-                    "binary",
-                    COMPUTER_RFB_WEBSOCKET_PROTOCOL,
-                    `${BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX}${token}`,
-                  ],
-                }
-              : {
-                  kind: "direct_websocket" as const,
-                  url: await client.computerFrameStreamUrl(
-                    reference,
-                    request.targetId,
-                    request.stream,
-                  ),
-                  protocols: [
-                    COMPUTER_CONTROL_WEBSOCKET_PROTOCOL,
-                    `${BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX}${token}`,
-                  ],
-                };
+            : await (async () => {
+                const rfb =
+                  record.session.placement.kind === "sandbox_group" &&
+                  record.session.platform === "linux" &&
+                  target.kind === "screen";
+                const protocols = rfb
+                  ? [
+                      "binary",
+                      COMPUTER_RFB_WEBSOCKET_PROTOCOL,
+                      `${BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX}${token}`,
+                    ]
+                  : [
+                      COMPUTER_CONTROL_WEBSOCKET_PROTOCOL,
+                      `${BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX}${token}`,
+                    ];
+                const upstreamUrl = rfb
+                  ? await client.computerRfbStreamUrl(reference, request.targetId)
+                  : await client.computerFrameStreamUrl(
+                      reference,
+                      request.targetId,
+                      request.stream,
+                    );
+                const attachment = placementUsesInteractionFrameProxy(placement.lease?.backend, {
+                  openSandboxSignedEndpoints: deps.settings.openSandboxSignedEndpoints,
+                  ...(typeof deps.settings.openSandboxInteractionFrameProxy === "boolean"
+                    ? {
+                        openSandboxInteractionFrameProxy:
+                          deps.settings.openSandboxInteractionFrameProxy,
+                      }
+                    : {}),
+                })
+                  ? createInteractionFrameProxyAttachment({
+                      requestUrl: context.req.url,
+                      publicBaseUrl: deps.settings.publicBaseUrl,
+                      webBaseUrl: deps.settings.webBaseUrl,
+                      forwardedProto: context.req.header("x-forwarded-proto"),
+                      forwardedHost:
+                        context.req.header("x-forwarded-host") ?? context.req.header("host"),
+                      rootSecret: controllerAuthorityRoot(deps),
+                      upstreamUrl,
+                      upstreamProtocols: protocols,
+                      origin,
+                      expiresAt,
+                    })
+                  : { url: upstreamUrl, protocols };
+                return rfb
+                  ? { kind: "direct_rfb" as const, ...attachment }
+                  : { kind: "direct_websocket" as const, ...attachment };
+              })();
           return ComputerSessionAttachment.parse({
             computerSessionId,
             controllerGeneration: binding.controllerGeneration,
@@ -614,7 +688,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
       const computerSessionId = requireUuidParam(context, "computerSessionId");
       const request = await parseJsonBody(context, ComputerSessionLifecycleRequest);
       const startedAtMs = performance.now();
-      const origin = requestOrigin(context, deps.settings.corsAllowOriginRegex);
+      const origin = requestOrigin(context, deps.settings);
       try {
         const before = await getComputerSessionControlRecord(deps.db, {
           accountId: grant.accountId,
@@ -765,23 +839,41 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
       if (device.state !== "connected") {
         throw new ComputerSessionStateError("Attached browser machine is disconnected");
       }
-      const enrollment = await getEnrollment(
+      const enrollment = await getLiveEnrollmentConnection(
         deps.db,
         sourceSession.workspaceId,
         device.enrollmentId,
       );
-      if (!enrollment || enrollment.status !== "active") {
+      if (!enrollment || enrollment.status !== "active" || !enrollment.connectionInstanceId) {
         throw new ComputerSessionStateError("Attached browser machine is unavailable");
       }
-      assertPlacementInstance(expectedPlacementInstanceId, device.connectionGeneration);
+      if (!enrollment.workspaceRoot) {
+        throw new ComputerSessionStateError(
+          "Attached browser machine has not reported an absolute workspace root",
+        );
+      }
+      if (operation !== "computer.end") {
+        assertConnectedMachineComputerAccess(enrollment, operation);
+      }
+      const placementInstanceId = attachedEndPlacementInstanceId(
+        operation,
+        expectedPlacementInstanceId,
+        device.connectionGeneration,
+      );
       const built = await buildSelfhostedBackendSession({
         workspaceId: sourceSession.workspaceId,
         agentId: device.enrollmentId,
+        connectionInstanceId: enrollment.connectionInstanceId,
+        workspaceRoot: enrollment.workspaceRoot,
         relay: relayConfigFromSettings(deps.settings),
         controlRpcFactory: () => new NatsControlRpc(async () => deps.bus.getRequestConnection()),
         epoch: 0,
         timeoutMs: deps.settings.sandboxSelfhostedControlTimeoutMs,
         execTimeoutMs: deps.settings.sandboxSelfhostedExecTimeoutMs,
+        operationResourcePolicy: enrollment.operationPolicy,
+        operationResourcePolicySupported:
+          enrollment.agentCapabilities.operationResourcePolicy === true,
+        operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
         ...(deps.settings.agentOpStreamEnabled === true &&
         enrollment.opStream === true &&
         deps.bus.getOpStreamConnection
@@ -797,7 +889,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
       waitSignal.throwIfAborted();
       return await callback({
         placement: expectedPlacement,
-        placementInstanceId: device.connectionGeneration,
+        placementInstanceId,
         session: built.session as unknown as BrowserControlPlacementSession,
         lease: null,
       });
@@ -838,13 +930,30 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         }
 
         const resolved = await handle.routingSession.prime();
+        if (operation !== "computer.end" && resolved.kind === "selfhosted" && resolved.sandboxId) {
+          const sandbox = await getSandbox(deps.db, grant, resolved.sandboxId);
+          if (sandbox?.kind !== "selfhosted" || !sandbox.enrollmentId) {
+            throw new ComputerSessionStateError("Connected Machine placement is unavailable");
+          }
+          const enrollment = await getLiveEnrollmentConnection(
+            deps.db,
+            grant,
+            sandbox.enrollmentId,
+          );
+          if (!enrollment?.connectionInstanceId) {
+            throw new ComputerSessionStateError("Connected Machine is unavailable");
+          }
+          assertConnectedMachineComputerAccess(enrollment, operation);
+        }
         if (expectedPlacement?.kind === "connected_machine") {
           if (
             resolved.kind !== "selfhosted" ||
             resolved.sandboxId !== expectedPlacement.sandboxId
           ) {
-            throw new ComputerSessionStateError(
-              "ComputerSession Connected Machine is not the active placement",
+            return await throwComputerSourcePlacementChanged(
+              grant,
+              sourceSession.id,
+              expectedPlacement.sandboxId,
             );
           }
           const placementInstanceId = resolved.providerInstanceId ?? expectedPlacement.sandboxId;
@@ -878,7 +987,10 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         }
         if (resolved.kind === "selfhosted") {
           return await callback({
-            placement: { kind: "connected_machine", sandboxId: resolved.sandboxId },
+            placement: {
+              kind: "connected_machine",
+              sandboxId: resolved.sandboxId,
+            },
             placementInstanceId: resolved.providerInstanceId ?? resolved.sandboxId,
             session: resolved.session as unknown as BrowserControlPlacementSession,
             lease: null,
@@ -914,7 +1026,9 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
       !lease ||
       (lease.liveness !== "warm" && lease.liveness !== "draining") ||
       lease.instanceId !== binding.placementInstanceId ||
-      !lease.controllerDataPlaneUrl
+      !lease.controllerDataPlaneUrl ||
+      (lease.backend === "opensandbox" && deps.settings.openSandboxSignedEndpoints) ||
+      !controllerCachedUrlIsUsable(lease.controllerDataPlaneUrl)
     ) {
       return null;
     }
@@ -938,8 +1052,29 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     ) {
       return placement;
     }
+    if (placement.lease.backend === "opensandbox" && deps.settings.openSandboxSignedEndpoints) {
+      if (!placement.lease.controllerDataPlaneUrl) return placement;
+      const lease = await recordLeaseControllerDataPlaneUrl(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        sandboxGroupId: placement.placement.sandboxGroupId,
+        expectedEpoch: placement.lease.leaseEpoch,
+        expectedInstanceId: placement.lease.instanceId,
+        controllerDataPlaneUrl: null,
+      });
+      return lease ? { ...placement, lease } : placement;
+    }
     const endpoint = await placement.session.resolveExposedPort(BROWSER_CONTROL_PORT);
     const url = buildStreamUrl(endpoint);
+    if (
+      !shouldPersistControllerDataPlaneUrl({
+        backend: placement.lease.backend,
+        signedEndpoints: deps.settings.openSandboxSignedEndpoints,
+        url,
+      })
+    ) {
+      return placement;
+    }
     const lease = await recordLeaseControllerDataPlaneUrl(deps.db, {
       accountId: grant.accountId,
       workspaceId,
@@ -949,6 +1084,9 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
       controllerDataPlaneUrl: url,
     });
     if (!lease) return placement;
+    if (!controllerCacheAllowsHostFetch(url)) {
+      return { ...placement, lease };
+    }
     return { ...placement, session: controllerOnlySession(url), lease };
   }
 
@@ -964,7 +1102,13 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     const sandboxGroupId =
       placement.placement.kind === "sandbox_group" ? placement.placement.sandboxGroupId : null;
     return await withCachedController({
-      cachedUrl: sandboxGroupId ? (cachedUrl ?? null) : null,
+      cachedUrl:
+        sandboxGroupId &&
+        cachedUrl &&
+        !(placement.lease?.backend === "opensandbox" && deps.settings.openSandboxSignedEndpoints) &&
+        controllerCachedUrlIsUsable(cachedUrl)
+          ? cachedUrl
+          : null,
       createCachedClient: (url) =>
         new BrowserControlClient(controllerOnlySession(url), { adminToken }),
       prepareCachedClient: async (client) => {
@@ -1016,6 +1160,17 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         computerSessionId,
       });
       await authorizeSourceSession(deps, grant, record.sourceSessionId, authorizationOperation);
+      let sourceSession: Session | null = null;
+      if (record.session.placement?.kind === "connected_machine") {
+        sourceSession = await requireSourceSession(deps, workspaceId, record.sourceSessionId);
+        if (sourceSession.activeSandboxId !== record.session.placement.sandboxId) {
+          return await throwComputerSourcePlacementChanged(
+            grant,
+            record.sourceSessionId,
+            record.session.placement.sandboxId,
+          );
+        }
+      }
       if (record.session.lifecycle !== "active" || !record.session.controller) {
         throw new ComputerSessionStateError("ComputerSession is not active");
       }
@@ -1096,7 +1251,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         }
       }
 
-      const sourceSession = await requireSourceSession(deps, workspaceId, record.sourceSessionId);
+      sourceSession ??= await requireSourceSession(deps, workspaceId, record.sourceSessionId);
       return await withComputerPlacement(
         sourceSession,
         grant,
@@ -1116,6 +1271,25 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     }
   }
 
+  async function throwComputerSourcePlacementChanged(
+    grant: AccessGrant,
+    sourceSessionId: string,
+    connectedSandboxId: string,
+  ): Promise<never> {
+    const reconciliation = await terminalizeStaleConnectedInteractionPlacement(deps.db, {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+      sourceSessionId,
+      connectedSandboxId,
+    });
+    if (reconciliation.sourcePlacementChanged) {
+      throw sourcePlacementChangedApiError("computer_session");
+    }
+    throw new ComputerSessionStateError(
+      "ComputerSession source placement changed during the request; retry",
+    );
+  }
+
   async function ensureInteractionHolder(
     grant: AccessGrant,
     sourceSession: Session,
@@ -1127,6 +1301,11 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     if (!placement.lease?.instanceId) {
       throw new ComputerSessionStateError("ComputerSession lease placement is unavailable");
     }
+    const sandboxRuntime = await resolveSessionSandboxRuntime(
+      deps.db,
+      deps.settings,
+      sourceSession,
+    );
     const acquired = await acquireLease(deps.db, {
       accountId: grant.accountId,
       workspaceId: sourceSession.workspaceId,
@@ -1136,8 +1315,8 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
       subjectId: sourceSession.id,
       backend: placement.lease.backend,
       os: placement.lease.os,
-      image: placement.lease.image,
-      rigVersionId: placement.lease.rigVersionId,
+      image: sandboxRuntime.image,
+      rigVersionId: sourceSession.rigVersionId,
       leaseTtlMs: deps.settings.sandboxLeaseTtlMs,
       expectedEpoch: placement.lease.leaseEpoch,
       waitSignal,
@@ -1158,6 +1337,11 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
       ).catch(() => undefined);
       throw new ComputerSessionStateError("ComputerSession placement fence changed; retry");
     }
+    await renewSandboxProviderExpiration({
+      backend: acquired.lease.backend as ApiRouteDeps["settings"]["sandboxBackend"],
+      settings: deps.settings,
+      instanceId: acquired.lease.instanceId,
+    }).catch(() => false);
     return true;
   }
 
@@ -1273,7 +1457,11 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
   async function routePreamble(
     context: Context,
     permission: "sessions:read" | "sessions:control" | "stream:view",
-  ): Promise<{ workspaceId: string; grant: AccessGrant; computerSessionId: string }> {
+  ): Promise<{
+    workspaceId: string;
+    grant: AccessGrant;
+    computerSessionId: string;
+  }> {
     const workspaceId = context.req.param("workspaceId") ?? "";
     const grant = await requireAccessGrant(context, deps, workspaceId, permission);
     return {
@@ -1284,6 +1472,21 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
   }
 }
 
+function sourcePlacementChangedApiError(interactionResource: "computer_session"): ApiHttpError {
+  return new ApiHttpError(409, {
+    code: "conflict",
+    message:
+      "This Desktop belonged to a previous task placement and was retired. Open a new Desktop.",
+    retryable: false,
+    outcomeUnknown: false,
+    details: {
+      interactionResource,
+      interactionFailureCode: "source_placement_changed",
+      interactionLifecycle: "lost",
+    },
+  });
+}
+
 function computerCreateInput(
   grant: AccessGrant,
   workspaceId: string,
@@ -1400,7 +1603,10 @@ async function authorizeSourceSession(
     });
   } catch (error) {
     if (error instanceof SessionAuthorizationDeniedError) {
-      throw new HTTPException(404, { message: "session not found", cause: error });
+      throw new HTTPException(404, {
+        message: "session not found",
+        cause: error,
+      });
     }
     if (error instanceof SessionAuthorizationUnavailableError) {
       throw new HTTPException(503, {
@@ -1456,26 +1662,8 @@ function requireOpaqueParam(context: Context, name: string): string {
   return value;
 }
 
-function requestOrigin(context: Context, allowedPattern: string): string | null {
-  const value = context.req.header("origin");
-  if (!value) return null;
-  let url: URL;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new HTTPException(400, { message: "invalid request origin" });
-  }
-  if (
-    url.origin === "null" ||
-    (url.protocol !== "http:" && url.protocol !== "https:") ||
-    url.origin !== value
-  ) {
-    throw new HTTPException(400, { message: "invalid request origin" });
-  }
-  if (!allowedCorsOrigin(allowedPattern, url.origin)) {
-    throw new HTTPException(403, { message: "request origin is not allowed" });
-  }
-  return url.origin;
+function requestOrigin(context: Context, settings: ApiRouteDeps["settings"]): string | null {
+  return validateInteractionRequestOrigin(context.req.header("origin"), settings);
 }
 
 function interactionActorForGrant(grant: AccessGrant): ReturnType<typeof InteractionActor.parse> {
@@ -1501,6 +1689,39 @@ function assertPlacementInstance(expected: string | null, actual: string): void
   }
 }
 
+/** End must still reach the live agent with the session's original token
+ *  fence. A later Chrome generation must not block ScreenCaptureKit teardown. */
+function attachedEndPlacementInstanceId(
+  operation: ChannelAOperation,
+  expectedPlacementInstanceId: string | null,
+  liveGeneration: string,
+): string {
+  if (operation === "computer.end" && expectedPlacementInstanceId) {
+    return expectedPlacementInstanceId;
+  }
+  assertPlacementInstance(expectedPlacementInstanceId, liveGeneration);
+  return liveGeneration;
+}
+
+function assertConnectedMachineComputerAccess(
+  enrollment: {
+    hasDisplay: boolean;
+    desktopUnavailableReason: string | null;
+    allowScreenControl: boolean;
+  },
+  operation: ChannelAOperation,
+): void {
+  const error = connectedMachineComputerAccessError(
+    enrollment,
+    operation === "computer.action" || operation === "computer.control",
+  );
+  if (!error) return;
+  if (error.status === 403) {
+    throw new HTTPException(403, { message: error.message });
+  }
+  throw new ComputerSessionStateError(error.message);
+}
+
 function isTerminalOperation(state: string): boolean {
   return state === "completed" || state === "failed" || state === "outcome_unknown";
 }
@@ -1521,7 +1742,11 @@ function interactionFailure(error: unknown) {
     error instanceof BrowserControlUnsupportedError ||
     error instanceof BrowserControlServerUnsupportedError
   ) {
-    return { code: "unsupported" as const, message: error.message, retryable: false };
+    return {
+      code: "unsupported" as const,
+      message: error.message,
+      retryable: false,
+    };
   }
   if (error instanceof BrowserControlServerError) {
     return {
@@ -1541,6 +1766,8 @@ function interactionFailure(error: unknown) {
 }
 
 function computerRouteError(error: unknown): HTTPException {
+  const connectedMachineError = interactionControlApiError(error, "computer");
+  if (connectedMachineError) return connectedMachineError;
   if (error instanceof HTTPException) return error;
   if (error instanceof ComputerSessionNotFoundError) {
     return new HTTPException(404, { message: error.message, cause: error });