@opengeni/api-router 1.4.5-canary.38533733713001 → 2.0.1

package/src/connection-ownership.ts

@@ -62,7 +62,7 @@ export function requireLegacyOAuthActor(access: AccessGrantAuthorization): void
  * The allow-list that actually decides is `principalKind === "human_session"`.
  * This list is defence-in-depth against exactly one residual threat: a holder
  * of the first-party delegation secret signing a human claim over an
- * OpenGeni-minted machine subject.
+ * Opengeni-minted machine subject.
  *
  * `connection-ownership.test.ts` asserts that every machine subject named in
  * its list is rejected. Note what that does and does not buy: it catches a
@@ -108,7 +108,7 @@ export function isPersonalConnectionOwnerPrincipal(access: AccessGrantAuthorizat
   );
 }
 
-/** Rejects an OpenGeni-minted machine subject; see the namespace list's rationale. */
+/** Rejects an Opengeni-minted machine subject; see the namespace list's rationale. */
 export function isPersonalConnectionOwnerSubject(subjectId: string): boolean {
   const separator = subjectId.indexOf(":");
   if (separator < 0) {

package/src/integrations/oauth-client.ts

@@ -672,28 +672,27 @@ async function startMcpOAuthWithinDeadline(
     ...(existing ? { connectionId: existing.id, connectionVersion: existing.version } : {}),
   });
   const expiresAt = new Date(Date.now() + oauthStateTtlMs);
-  let state = fullState;
-  if (settings.integrationsOauthShortStateEnabled) {
-    const stateId = randomUUID();
-    state = createSignedState(requireIntegrationsStateSecret(settings), {
-      kind: "mcp_oauth_reference",
+  // Providers cap `state` length (Stripe at 1024 characters), so only a short
+  // signed reference leaves; the full context waits encrypted at rest.
+  const stateId = randomUUID();
+  const state = createSignedState(requireIntegrationsStateSecret(settings), {
+    kind: "mcp_oauth_reference",
+    id: stateId,
+    accountId: context.accountId,
+    workspaceId: context.workspaceId,
+  });
+  if (state.length > 512) {
+    throw new Error("MCP OAuth reference state exceeded its provider-safe length");
+  }
+  await deadline.run("state_persist", async () =>
+    storeIntegrationOAuthPendingState(db, {
       id: stateId,
       accountId: context.accountId,
       workspaceId: context.workspaceId,
-    });
-    if (state.length > 512) {
-      throw new Error("MCP OAuth reference state exceeded its provider-safe length");
-    }
-    await deadline.run("state_persist", async () =>
-      storeIntegrationOAuthPendingState(db, {
-        id: stateId,
-        accountId: context.accountId,
-        workspaceId: context.workspaceId,
-        stateEncrypted: encryptEnvironmentValue(key, fullState),
-        expiresAt,
-      }),
-    );
-  }
+      stateEncrypted: encryptEnvironmentValue(key, fullState),
+      expiresAt,
+    }),
+  );
   const authorizationUrl = buildAuthorizationUrl({
     endpoint: discovery.as.authorizationEndpoint,
     settings,

package/src/mcp/action-descriptions.ts

@@ -51,7 +51,7 @@ const RULES: Rule[] = [
     method: "PATCH",
     pattern: /\/(codex|claude|supergrok)\/accounts\/:accountId\/allocator$/,
     text: ({ provider }) =>
-      `Turn "Use for new work" on or off for a ${provider} account (pause or resume it). Paused accounts aren't picked for new chats or schedules; running work continues. Send the current allocator version.`,
+      `Turn "Enable account" on or off for a ${provider} account (enable or disable it, sometimes called pause or resume). Disabled accounts aren't picked for new chats or schedules; running work continues. Send the current allocator version.`,
   },
   {
     method: "PATCH",

package/src/mcp/server.ts

@@ -4262,7 +4262,7 @@ function registerFleetTools(
     "sandbox_provision",
     {
       description:
-        "Provision a new sandbox for the fleet. kind=selfhosted posts the Connected Machine card in this chat: the person copies a one-line connect command, runs it on their own computer, and picks Use in this chat; the card also offers the OpenGeni Browser Chrome extension once the machine is connected. When you can already run commands on the target machine, install it yourself with connected_machine_enroll_token instead. kind=modal creates a named Modal sandbox record, but it is NOT yet attachable as a swap target: routing a session onto a second Modal box is not supported yet, so sandbox_swap to its id is rejected. Use the session's own box (the default) or attach a Connected Machine instead.",
+        "Provision a new sandbox for the fleet. kind=selfhosted posts the Connected Machine card in this chat: the person copies a one-line connect command, runs it on their own computer, and picks Use in this chat; the card also offers the Opengeni Browser Chrome extension once the machine is connected. When you can already run commands on the target machine, install it yourself with connected_machine_enroll_token instead. kind=modal creates a named Modal sandbox record, but it is NOT yet attachable as a swap target: routing a session onto a second Modal box is not supported yet, so sandbox_swap to its id is rejected. Use the session's own box (the default) or attach a Connected Machine instead.",
       inputSchema: {
         kind: z4.enum(["selfhosted", "modal"]),
         name: z4.string().min(1).max(120).optional(),
@@ -4303,7 +4303,7 @@ function registerFleetTools(
             setup.status === "ready"
               ? `${setup.detail} The Connected Machine card lists them with Use in this chat and can connect another.`
               : "The Connected Machine card was posted. The person copies its one-line connect command, runs it on their machine, and picks Use in this chat; nothing is connected yet."
-          } Check sandboxes_list after they confirm. Chrome needs the OpenGeni Browser extension (${OPENGENI_BROWSER_EXTENSION_URL}) on the connected machine.`,
+          } Check sandboxes_list after they confirm. Chrome needs the Opengeni Browser extension (${OPENGENI_BROWSER_EXTENSION_URL}) on the connected machine.`,
         });
       }
       return json(
@@ -4332,7 +4332,7 @@ function registerConnectedMachineTools(
     "connected_machine_enroll_token",
     {
       description:
-        "Create a single-use Connected Machine enrollment token for this workspace (expires in one hour) using existing enrollments:manage authority. Returns the token, expiry and Unix/PowerShell install commands. Use it when you can run commands on the target machine yourself (run_on, SSH, a VM you control): run the matching command there, then verify the machine with sandboxes_list. One token connects one machine; mint another for each additional machine (the same machine may rerun its command). When the person must run it on their own computer, post the Connected Machine card instead (capability_authorization_request with api:connected-machine), which mints the command in their browser; do not paste a token into the chat. Screen control is optional and defaults off; to turn it on for a machine that is already connected, use connected_machine_enable_screen_control instead of reconnecting. The token grants whole-machine access on enrollment; do not put it in public code or unrelated logs. Existing machine connections are preserved. For Chrome, the person installs the OpenGeni Browser extension (" +
+        "Create a single-use Connected Machine enrollment token for this workspace (expires in one hour) using existing enrollments:manage authority. Returns the token, expiry and Unix/PowerShell install commands. Use it when you can run commands on the target machine yourself (run_on, SSH, a VM you control): run the matching command there, then verify the machine with sandboxes_list. One token connects one machine; mint another for each additional machine (the same machine may rerun its command). When the person must run it on their own computer, post the Connected Machine card instead (capability_authorization_request with api:connected-machine), which mints the command in their browser; do not paste a token into the chat. Screen control is optional and defaults off; to turn it on for a machine that is already connected, use connected_machine_enable_screen_control instead of reconnecting. The token grants whole-machine access on enrollment; do not put it in public code or unrelated logs. Existing machine connections are preserved. For Chrome, the person installs the Opengeni Browser extension (" +
         OPENGENI_BROWSER_EXTENSION_URL +
         ") after the machine is connected.",
       inputSchema: { allowScreenControl: z4.boolean().optional() },
@@ -4363,7 +4363,7 @@ function registerConnectedMachineTools(
     "connected_machine_enable_screen_control",
     {
       description:
-        "Turn screen control on for a machine that is already connected, in place, so agents can see and use its screen (computer and attached-Chrome tools). `target` is a sandboxes_list id or an enrollment id. Needs no human click, token, terminal or reconnect: OpenGeni records the consent on that machine and its agent refreshes its own credentials over the live connection. status=active means it is on now. status=pending means it is allowed and turns on by itself: reason=offline when the machine next connects; reason=agent_update_required after its agent is updated (update it with the machine update action, POST /v1/workspaces/{workspaceId}/machines/{enrollmentId}/update); reason=renewal_failed: call again shortly; reason=reconnect_required: the machine's connection predates in-place changes, so rerun the connect command on it (connected_machine_enroll_token with allowScreenControl=true). On a Mac the OS must also allow Screen Recording, Accessibility and Input Monitoring for OpenGeni: open each pane on the Mac with run_on exec `open 'x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture'` (Privacy_Accessibility, Privacy_ListenEvent; also the privacy-settings machine action) and ask the person to switch OpenGeni on there, choosing Quit & Reopen if macOS asks; the machine list reports runtime.macPermissions. Chrome additionally needs the OpenGeni Browser extension (" +
+        "Turn screen control on for a machine that is already connected, in place, so agents can see and use its screen (computer and attached-Chrome tools). `target` is a sandboxes_list id or an enrollment id. Needs no human click, token, terminal or reconnect: Opengeni records the consent on that machine and its agent refreshes its own credentials over the live connection. status=active means it is on now. status=pending means it is allowed and turns on by itself: reason=offline when the machine next connects; reason=agent_update_required after its agent is updated (update it with the machine update action, POST /v1/workspaces/{workspaceId}/machines/{enrollmentId}/update); reason=renewal_failed: call again shortly; reason=reconnect_required: the machine's connection predates in-place changes, so rerun the connect command on it (connected_machine_enroll_token with allowScreenControl=true). On a Mac the OS must also allow Screen Recording, Accessibility and Input Monitoring for Opengeni: open each pane on the Mac with run_on exec `open 'x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture'` (Privacy_Accessibility, Privacy_ListenEvent; also the privacy-settings machine action) and ask the person to switch Opengeni on there, choosing Quit & Reopen if macOS asks; the machine list reports runtime.macPermissions. Chrome additionally needs the Opengeni Browser extension (" +
         OPENGENI_BROWSER_EXTENSION_URL +
         ") on that machine.",
       inputSchema: { target: z4.string().min(1) },
@@ -6555,7 +6555,7 @@ function registerCapabilityDiscoveryTools(
     "capability_authorization_request",
     {
       description:
-        "Show a Connect card in this chat for a suitable capability returned by capability_catalog_search with setup.nextAction. Supply its capability ID and a brief rationale explaining how it helps the task; no separate confirmation is needed before showing the card. Requesting setup needs no integration-management permission and grants no access. The authenticated human completes setup through the card; never ask them to paste credentials into chat. Do not request another card for the same pending setup, or for a candidate reported ready or unavailable. GitHub App (api:github-app) and Connected Machine (api:connected-machine) are exceptions: when already connected their card is still shown, listing repositories or machines the person can use in this chat. Use api:connected-machine when the person should connect their own computer: the card gives them a one-line connect command and the OpenGeni Browser Chrome extension link; never paste an enroll token into the chat yourself." +
+        "Show a Connect card in this chat for a suitable capability returned by capability_catalog_search with setup.nextAction. Supply its capability ID and a brief rationale explaining how it helps the task; no separate confirmation is needed before showing the card. Requesting setup needs no integration-management permission and grants no access. The authenticated human completes setup through the card; never ask them to paste credentials into chat. Do not request another card for the same pending setup, or for a candidate reported ready or unavailable. GitHub App (api:github-app) and Connected Machine (api:connected-machine) are exceptions: when already connected their card is still shown, listing repositories or machines the person can use in this chat. Use api:connected-machine when the person should connect their own computer: the card gives them a one-line connect command and the Opengeni Browser Chrome extension link; never paste an enroll token into the chat yourself." +
         (secretsSelected
           ? ' For a single password, API key or code for a service with no connector here, ask with a kind: "secret" question in request_human_input instead; you get a saved reference back.'
           : ""),
@@ -6610,7 +6610,7 @@ function registerCapabilityDiscoveryTools(
           capabilityId: item.id,
           status: "ready",
           eventId,
-          message: `${setup.detail} The Connected Machine card is in this chat: the person can pick a machine with "Use in this chat" or connect another. Chrome needs the OpenGeni Browser extension (${OPENGENI_BROWSER_EXTENSION_URL}) on a connected machine.`,
+          message: `${setup.detail} The Connected Machine card is in this chat: the person can pick a machine with "Use in this chat" or connect another. Chrome needs the Opengeni Browser extension (${OPENGENI_BROWSER_EXTENSION_URL}) on a connected machine.`,
         });
       }
       if (githubCardWhenReady) {

package/src/routes/browser-sessions.ts

@@ -1,3 +1,4 @@
+import { attachedBrowserViewer } from "../attached-browser-viewer";
 import {
   assertEphemeralBrowserCreateEnabled,
   ephemeralBrowserPartition,
@@ -271,8 +272,7 @@ export function registerBrowserSessionRoutes(
     return context.json(
       AttachedBrowserDeviceListResponse.parse(
         await listAttachedBrowserDevices(deps.db, {
-          accountId: grant.accountId,
-          workspaceId,
+          ...(await attachedBrowserViewer(deps, grant, workspaceId)),
           includeDisconnected,
         }),
       ),
@@ -287,8 +287,7 @@ export function registerBrowserSessionRoutes(
       return context.json(
         AttachedBrowserDevice.parse(
           await getAttachedBrowserDevice(deps.db, {
-            accountId: grant.accountId,
-            workspaceId,
+            ...(await attachedBrowserViewer(deps, grant, workspaceId)),
             deviceId,
           }),
         ),
@@ -2692,20 +2691,17 @@ export function registerBrowserSessionRoutes(
   ): Promise<T> {
     if (expectedPlacement?.kind === "attached_device") {
       waitSignal.throwIfAborted();
+      // Personal machines are controlled only for their owner, as everywhere else.
+      const viewer = await attachedBrowserViewer(deps, grant, sourceSession.workspaceId);
       const device = await getAttachedBrowserDevice(deps.db, {
-        accountId: grant.accountId,
-        workspaceId: sourceSession.workspaceId,
+        ...viewer,
         deviceId: expectedPlacement.deviceId,
       });
       if (device.state !== "connected") {
         recordAttachedBrowserUnavailable(deps.observability, "disconnected");
         throw new BrowserSessionStateError("Attached browser is disconnected");
       }
-      const enrollment = await getLiveEnrollmentConnection(
-        deps.db,
-        sourceSession.workspaceId,
-        device.enrollmentId,
-      );
+      const enrollment = await getLiveEnrollmentConnection(deps.db, viewer, device.enrollmentId);
       if (!enrollment || enrollment.status !== "active" || !enrollment.connectionInstanceId) {
         recordAttachedBrowserUnavailable(deps.observability, "machine_unavailable");
         throw new BrowserSessionStateError("Attached browser machine is unavailable");

package/src/routes/codex-core.ts

@@ -125,7 +125,9 @@ export async function coreCodexConnected(
       default:
         throw new HTTPException(403, {
           message:
-            "only an organization administrator can connect a new shared Codex account; workspace administrators can reconnect the accounts their workspace manages",
+            input.workspaceId === null
+              ? "only an organization administrator can connect a Codex account for the whole organization"
+              : "only an administrator of this workspace or of the organization can connect a Codex account here",
         });
     }
   }
@@ -155,7 +157,8 @@ export async function coreCodexConnected(
 function disconnectRefused(outcome: SubscriptionCoreCodexDisconnectOutcome): void {
   if (outcome === "forbidden") {
     throw new HTTPException(403, {
-      message: "only an organization administrator can disconnect a shared Codex account",
+      message:
+        "only an organization administrator can disconnect this Codex account; a workspace administrator can disconnect only an account that serves just their workspace",
     });
   }
   if (outcome === "unresolved_redemption") {

package/src/routes/computer-sessions.ts

@@ -1,3 +1,4 @@
+import { attachedBrowserViewer } from "../attached-browser-viewer";
 import { randomUUID } from "node:crypto";
 import {
   resolveFirstPartyDelegationSecret,
@@ -1114,19 +1115,16 @@ export function registerComputerSessionRoutes(
     }
     if (expectedPlacement?.kind === "attached_device") {
       waitSignal.throwIfAborted();
+      // Personal machines are controlled only for their owner, as everywhere else.
+      const viewer = await attachedBrowserViewer(deps, grant, sourceSession.workspaceId);
       const device = await getAttachedBrowserDevice(deps.db, {
-        accountId: grant.accountId,
-        workspaceId: sourceSession.workspaceId,
+        ...viewer,
         deviceId: expectedPlacement.deviceId,
       });
       if (device.state !== "connected") {
         throw new ComputerSessionStateError("Attached browser machine is disconnected");
       }
-      const enrollment = await getLiveEnrollmentConnection(
-        deps.db,
-        sourceSession.workspaceId,
-        device.enrollmentId,
-      );
+      const enrollment = await getLiveEnrollmentConnection(deps.db, viewer, device.enrollmentId);
       if (!enrollment || enrollment.status !== "active" || !enrollment.connectionInstanceId) {
         throw new ComputerSessionStateError("Attached browser machine is unavailable");
       }

package/src/routes/machines.ts

@@ -315,7 +315,7 @@ export function registerMachineRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   // ── POST /workspaces/:ws/machines/:enrollmentId/privacy-settings ───────────
   // Open one macOS Privacy & Security pane on the connected Mac, so the person
-  // only flips the switch for OpenGeni. Opening a pane grants nothing.
+  // only flips the switch for Opengeni. Opening a pane grants nothing.
   app.post("/v1/workspaces/:workspaceId/machines/:enrollmentId/privacy-settings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const authorization = await requireAccessGrantAuthorization(

package/src/routes/native-app-auth.ts

@@ -17,6 +17,7 @@ import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 import { runManagedAuthProvider } from "../auth/managed-auth-attempt-context";
+import { managedAuthSessionCookieHeaders } from "../auth/managed-auth-session-adapter";
 import { admitManagedSignInMutation } from "./managed-sign-in-methods";
 
 // Native app sign-in (RFC 8252 shape: authorization code + PKCE over a custom
@@ -32,13 +33,30 @@ const CODE_IDENTIFIER_PREFIX = "opengeni-native-app-code:";
 const PKCE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/u;
 const PKCE_CHALLENGE = /^[A-Za-z0-9_-]{43}$/u;
 const MANAGED_PROVIDERS = ["credential", "google", "github"] as const;
+export const NATIVE_APP_PLATFORMS = ["ios", "android", "macos", "windows", "linux"] as const;
+type NativeAppPlatform = (typeof NATIVE_APP_PLATFORMS)[number];
+const PLATFORM_LABELS: Record<NativeAppPlatform, string> = {
+  ios: "iOS",
+  android: "Android",
+  macos: "macOS",
+  windows: "Windows",
+  linux: "Linux",
+};
+
+/** The device label shown in the person's signed-in sessions. */
+export function nativeAppSessionUserAgent(
+  platform: NativeAppPlatform,
+  deviceName: string | null,
+): string {
+  return `Opengeni app (${PLATFORM_LABELS[platform]}${deviceName ? `; ${deviceName}` : ""})`;
+}
 
 const AuthorizeBody = z.object({
   redirectUri: z.string().min(1).max(512),
   codeChallenge: z.string().regex(PKCE_CHALLENGE),
   codeChallengeMethod: z.literal("S256"),
   state: z.string().min(8).max(256).optional(),
-  platform: z.enum(["ios", "android"]),
+  platform: z.enum(NATIVE_APP_PLATFORMS),
   deviceName: z.string().trim().min(1).max(80).optional(),
 });
 
@@ -61,7 +79,7 @@ const StoredGrant = z.object({
   providerId: z.enum(MANAGED_PROVIDERS),
   redirectUri: z.string(),
   codeChallenge: z.string().regex(PKCE_CHALLENGE),
-  platform: z.enum(["ios", "android"]),
+  platform: z.enum(NATIVE_APP_PLATFORMS),
   deviceName: z.string().nullable(),
 });
 
@@ -177,10 +195,9 @@ export function registerNativeAppAuthRoutes(app: Hono, deps: ApiRouteDeps): void
     ) {
       return context.json({ error: "invalid_grant" }, 400);
     }
-    const platform = grant.platform === "ios" ? "iOS" : "Android";
     const session = await runManagedAuthProvider(grant.providerId, () =>
       authContext.internalAdapter.createSession(grant.userId, false, {
-        userAgent: `Opengeni app (${platform}${grant.deviceName ? `; ${grant.deviceName}` : ""})`,
+        userAgent: nativeAppSessionUserAgent(grant.platform, grant.deviceName),
       }),
     );
     if (!session?.token || new Date(session.expiresAt).getTime() <= Date.now()) {
@@ -209,6 +226,36 @@ export function registerNativeAppAuthRoutes(app: Hono, deps: ApiRouteDeps): void
     return context.json({ signedOut: true });
   });
 
+  // A desktop app shows the deployment's own web app. It signs that window in
+  // with the same device session, so the window is an ordinary first-party web
+  // session and signing the device out ends both. The bearer is required: an
+  // ambient browser request can never mint this cookie.
+  app.post(`${base}/web-session`, async (context) => {
+    const auth = deps.managedAuth;
+    if (!auth) throw new HTTPException(404);
+    if (deps.settings.managedAuthSessionSetMode === "broker") {
+      throw new HTTPException(409, {
+        message: "This deployment signs browser windows in through login session sets",
+      });
+    }
+    const credential = bearer(context.req.header("authorization"));
+    if (!credential?.startsWith(NATIVE_APP_CREDENTIAL_PREFIX)) {
+      throw new HTTPException(401, { message: "Native app credential required" });
+    }
+    const session = await getNativeAppManagedSession(auth, credential, deps.db).catch(() => null);
+    if (typeof session?.session?.id !== "string") {
+      throw new HTTPException(401, { message: "Sign in again" });
+    }
+    for (const cookie of await managedAuthSessionCookieHeaders(
+      auth,
+      credential.slice(NATIVE_APP_CREDENTIAL_PREFIX.length),
+      context.req.header("cookie") ?? null,
+    )) {
+      context.header("set-cookie", cookie, { append: true });
+    }
+    return context.json({ signedIn: true });
+  });
+
   // Push registration belongs to the app session that registered it: signing
   // the app out, or revoking its session anywhere, removes it.
   const appSessionId = async (authorization: string | undefined): Promise<string> => {

package/src/routes/sessions.ts

@@ -22,7 +22,7 @@ import {
   RealtimeVoiceUnavailableError,
   TranscriptionBillingRefusedError,
 } from "@opengeni/core";
-import type { CreditDebitAttribution } from "@opengeni/db";
+import type { CreditDebitAttribution, SessionForkPointRefusal } from "@opengeni/db";
 import { creditDebitAttributionForGrant } from "../access-grant-rls";
 import { transcriptionBillingRefusal } from "../transcription/billing-refusal";
 import { resolveSiteSessionOrigin, withOptionalSiteCommandOrigin } from "../site-session-origin";
@@ -606,7 +606,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
   });
 
   // Every deployment has one fail-closed authorization seam for every HTTP
-  // session surface. The core boundary always enforces durable OpenGeni-owned
+  // session surface. The core boundary always enforces durable Opengeni-owned
   // private-session rules; an embedding host port can add narrower policy.
   // Register it before the routes so a newly added path cannot accidentally
   // inherit workspace access without an explicit operation classification. The
@@ -5603,6 +5603,17 @@ function sessionAuthorizationHttpError(error: unknown): HTTPException {
   throw error;
 }
 
+const SESSION_FORK_POINT_REFUSAL_MESSAGES: Record<SessionForkPointRefusal, string> = {
+  message_unavailable:
+    "Only your messages and the agent's replies can be fork points. Choose one of those, or fork the whole session.",
+  boundary_not_retained:
+    "This message is from before the conversation was compacted, so it can't be a fork point. Choose a more recent message, or fork the whole session.",
+  history_compacted:
+    "The conversation up to this message was compacted, so it can't be copied as it was then. Choose a more recent message, or fork the whole session.",
+  unfinished_tool_exchange:
+    "The agent was still waiting for a tool result at this message. Choose a later message, or fork the whole session.",
+};
+
 export function sessionTenancyHttpError(error: unknown): Error {
   if (error instanceof SessionTenancyManagedHumanRequiredError) {
     return new ApiHttpError(403, {
@@ -5665,6 +5676,14 @@ export function sessionTenancyHttpError(error: unknown): Error {
     });
   }
   if (error instanceof SessionTenancyInvalidRequestError) {
+    if (error.forkPointRefusal) {
+      return new ApiHttpError(422, {
+        code: "validation_failed",
+        message: SESSION_FORK_POINT_REFUSAL_MESSAGES[error.forkPointRefusal],
+        retryable: false,
+        details: { reason: `fork_point_${error.forkPointRefusal}` },
+      });
+    }
     return new ApiHttpError(422, {
       code: "validation_failed",
       message: "Invalid session tenancy request.",

package/src/routes/subscription-pool-core.ts

@@ -184,7 +184,7 @@ export function coreConnectRefused(
       return new HTTPException(personal ? 409 : 403, {
         message: personal
           ? `a private ${displayName} account is connected from your Personal workspace`
-          : `only an organization administrator can connect a new shared ${displayName} account; workspace administrators can reconnect the accounts their workspace manages`,
+          : `only an administrator of this workspace or of the organization can connect a ${displayName} account here`,
       });
   }
 }
@@ -194,7 +194,7 @@ function disconnectRefused(outcome: SubscriptionCoreDisconnectOutcome, displayNa
     throw new HTTPException(404, { message: `${displayName} account not found` });
   if (outcome === "forbidden")
     throw new HTTPException(403, {
-      message: `only an organization administrator can disconnect a shared ${displayName} account`,
+      message: `only an organization administrator can disconnect this ${displayName} account; a workspace administrator can disconnect only an account that serves just their workspace`,
     });
   if (outcome === "unresolved_redemption")
     throw new HTTPException(409, {

package/src/routes/vault-providers.ts

@@ -385,7 +385,7 @@ export function registerVaultProviderRoutes(
     );
   });
 
-  // The vaults a stored 1Password connection reaches, with the OpenGeni vault
+  // The vaults a stored 1Password connection reaches, with the Opengeni vault
   // each one is linked to (if any). One `vaults.list` request.
   app.get("/v1/workspaces/:workspaceId/connections/:connectionId/provider-vaults", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -427,7 +427,7 @@ export function registerVaultProviderRoutes(
   });
 
   /**
-   * Link a provider vault as an OpenGeni vault, then mirror its metadata.
+   * Link a provider vault as an Opengeni vault, then mirror its metadata.
    * The link stands even if the first sync fails; its status says why.
    */
   app.post("/v1/workspaces/:workspaceId/vaults/link", async (c) => {
@@ -555,7 +555,7 @@ export function registerVaultProviderRoutes(
       }
       const created = await provider.createVault(routeProviderContext(connectionId), {
         name: payload.name,
-        description: "Managed by OpenGeni",
+        description: "Managed by Opengeni",
         allowAdminsAccess: true,
         ...(payload.groupId ? { groupId: payload.groupId } : {}),
       });

package/src/sandbox/screen-control.ts

@@ -251,7 +251,7 @@ export async function reconcileScreenControlOnHello(
 }
 
 /** Open one macOS Privacy & Security pane on a connected Mac. Opening a pane
- * grants nothing; the person flips the switch for OpenGeni. */
+ * grants nothing; the person flips the switch for Opengeni. */
 export async function openMachinePrivacySettings(
   services: Services,
   input: {