@opengeni/api-router 3.0.1 → 3.1.2

package/src/site-frame-guard.ts

@@ -0,0 +1,107 @@
+import {
+  SITE_NO_ORIGIN_ID,
+  siteFrameBodyRefusal,
+  siteFrameFromHeaders,
+  siteFrameOperation,
+} from "@opengeni/contracts/site-session-http";
+import {
+  requireAccessGrant,
+  siteOriginsMatch,
+  siteSessionOriginFromMetadata,
+  withSiteSessionOrigin,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import { getSession } from "@opengeni/db";
+import type { Context, Next } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { ApiHttpError } from "./http/api-error";
+import { resolveSiteRequestOrigin } from "./site-session-origin";
+
+/** The agent's own Codemode SDK proxy checks the proxied path itself. */
+const CODEMODE_SDK_PROXY = /^\/v1\/workspaces\/[^/]+\/codemode\/sdk(?:\/|$)/u;
+/** Site Data and files under a published Site: `/published-artifacts/<id>/data|files`. */
+const SITE_DATA = /^\/v1\/workspaces\/[^/]+\/published-artifacts\/([^/]+)\/(?:data|files)(?:\/|$)/u;
+
+/**
+ * Server-side boundary for requests a host forwarded from a Site frame (the
+ * console bridge, a Codemode preview). Hosts already hold Site code to the
+ * `SITE_OPERATIONS` allowlist; the API enforces it again for any request that
+ * carries the host's frame headers:
+ *
+ * - only allowlisted operations reach a handler;
+ * - Site Data only for the frame's own published Site (403, as the Site Data
+ *   service's own frame clamp answers);
+ * - a session list names only the frame's own Site;
+ * - a per-session operation reaches only a session the same Site (or, for a
+ *   frame without a published Site, the same mounted frame) started; anything
+ *   else is the same 404 as a missing session;
+ * - a message, draft, queue or control body carries only the fields Site
+ *   code may set (`siteFrameBodyRefusal`): text and how the model answers it.
+ *   Approval decisions, answers to questions, resources, personal resource
+ *   attachments, MCP credential updates, connection accounts and model
+ *   context are refused with 403 `site_frame_field_forbidden`; the person
+ *   gives those in the console. Session creates get the same treatment in
+ *   the create route, which also applies the minimal Site profile;
+ * - a session operation runs inside its validated Site origin, so every
+ *   session or turn it starts records which Site it came from.
+ *
+ * Ordinary handlers still authorize every allowed operation with the
+ * viewer's own authority.
+ */
+export function siteFrameGuard(deps: ApiRouteDeps) {
+  return async (c: Context, next: Next) => {
+    const frame = siteFrameFromHeaders((name) => c.req.header(name));
+    const pathname = new URL(c.req.url).pathname;
+    if (!frame || c.req.method === "OPTIONS" || CODEMODE_SDK_PROXY.test(pathname)) {
+      await next();
+      return;
+    }
+    const data = SITE_DATA.exec(pathname);
+    if (data && !frame.siteId)
+      throw new HTTPException(403, { message: "This Site host does not provide Site Data" });
+    if (data && data[1] !== frame.siteId)
+      throw new HTTPException(403, { message: "A Site can only use its own data" });
+    const workspaceId = c.req.param("workspaceId") ?? "";
+    const match = siteFrameOperation(c.req.method, pathname, workspaceId, frame.siteId);
+    if (!match) throw new HTTPException(404, { message: "Unsupported Site session API path" });
+    // Workspace, model and config reads and Site Data (whose service clamps
+    // frames itself) start or reach no session.
+    if (!match.operation.id.startsWith("sessions.")) {
+      await next();
+      return;
+    }
+    const grant = await requireAccessGrant(c, deps, workspaceId);
+    const origin = await resolveSiteRequestOrigin(deps.db, grant, frame);
+    if (match.operation.id === "sessions.list") {
+      const origins = new URL(c.req.url).searchParams.getAll("originSiteId");
+      if (origins.length !== 1 || origins[0] !== (origin.siteId ?? SITE_NO_ORIGIN_ID))
+        throw new HTTPException(404, { message: "Unsupported Site session API path" });
+    }
+    if (match.sessionId !== null) {
+      const session = await getSession(deps.db, grant.workspaceId, match.sessionId).catch(
+        () => null,
+      );
+      if (!session || !siteOriginsMatch(origin, siteSessionOriginFromMetadata(session.metadata)))
+        throw new HTTPException(404, { message: "session not found" });
+    }
+    if (c.req.method !== "GET" && match.operation.id !== "sessions.create") {
+      // Hono caches the parsed body, so the route reads the same JSON.
+      const body: unknown = await c.req.json().catch(() => undefined);
+      const refused = siteFrameBodyRefusal(match.operation.id, match.suffix, body);
+      if (refused) throw siteFrameFieldForbidden(refused);
+    }
+    await withSiteSessionOrigin(origin, () => next());
+  };
+}
+
+/** 403 for a body field Site code may not send; names the field, never its value. */
+export function siteFrameFieldForbidden(field: string): ApiHttpError {
+  return new ApiHttpError(403, {
+    code: "forbidden",
+    message:
+      "A Site page can send message text only. Approvals, answers, resources, credentials and connection choices happen in the console.",
+    retryable: false,
+    outcomeUnknown: false,
+    details: { code: "site_frame_field_forbidden", field },
+  });
+}

package/src/site-publishing/agent-data-tools.ts

@@ -0,0 +1,250 @@
+import {
+  siteHostname,
+  type FirstPartyMcpToolName,
+  type SiteLimitProfileKind,
+} from "@opengeni/contracts";
+import { resolveFirstPartyMcpToolPolicy } from "@opengeni/config";
+import type { ApiRouteDeps } from "@opengeni/core";
+import {
+  consumeSiteRuntimeRate,
+  findSiteRuntimeAgentConversation,
+  getPublishedSite,
+  getSitePublication,
+  getSiteSqlDatabase,
+  isSiteWorkspaceMember,
+  siteRuntimeConversationViewerEmail,
+  type SiteRuntimeConversationViewerKind,
+} from "@opengeni/db";
+import type { PublishedSiteDataViewer } from "../site-data/service";
+import { siteSqlOffered } from "../site-sql/gateway";
+import { siteRuntimeLimitProfile, type SiteRuntimeHost } from "./runtime";
+import { siteServable } from "./service";
+import { effectiveSiteAccess, signedInSiteViewerKind, siteGuestsAllowed } from "./viewer";
+
+/**
+ * A published Site's own data tools for its agent. Every Site agent
+ * conversation (members, invited people and public visitors) gets them,
+ * pinned on the server to that Site and acting as the conversation's viewer:
+ * the same audience checks and row binding as the Site's page (per-viewer
+ * collections, owner binding, `:viewer` and query audiences such as
+ * `signed_in` or `managers`). Site management tools (publication, migrate,
+ * define, reset, import, export, enable, files and so on) are never given.
+ *
+ * - `site_data_query`, `site_data_write`: the Site's collections under the
+ *   viewer's access rules (guests only what each collection's guest rule allows).
+ * - `site_sql_run`: the Site's named queries, when Site SQL is on.
+ * - `site_sql_query`: read-only statements, for workspace members only, when
+ *   Site SQL is on.
+ */
+export const SITE_AGENT_DATA_TOOLS = Object.freeze([
+  "site_data_query",
+  "site_data_write",
+] as const satisfies readonly FirstPartyMcpToolName[]);
+export const SITE_AGENT_SQL_TOOLS = Object.freeze([
+  "site_sql_run",
+] as const satisfies readonly FirstPartyMcpToolName[]);
+export const SITE_AGENT_MEMBER_SQL_TOOLS = Object.freeze([
+  "site_sql_query",
+] as const satisfies readonly FirstPartyMcpToolName[]);
+
+/** The first-party permissions those tools need (Site Data writes need publish). */
+export const SITE_AGENT_DATA_TOOL_PERMISSIONS = Object.freeze([
+  "artifacts:read",
+  "artifacts:publish",
+] as const);
+
+export const SITE_AGENT_OTHER_SITE_MESSAGE = "This Site's assistant can only use this Site's data";
+export const SITE_AGENT_MANAGEMENT_MESSAGE =
+  "This Site's assistant can use the Site's data, not manage the Site";
+
+/** The data tools one viewer's Site agent conversation gets, within the deployment's tools. */
+export function siteAgentDataToolNames(input: {
+  viewerKind: SiteRuntimeConversationViewerKind;
+  /** Site SQL is offered here and turned on for this Site. */
+  siteSql: boolean;
+  /** The deployment's first-party tool allowlist. */
+  allowed: readonly string[];
+}): FirstPartyMcpToolName[] {
+  const names: FirstPartyMcpToolName[] = [
+    ...SITE_AGENT_DATA_TOOLS,
+    ...(input.siteSql ? SITE_AGENT_SQL_TOOLS : []),
+    ...(input.siteSql && input.viewerKind === "member" ? SITE_AGENT_MEMBER_SQL_TOOLS : []),
+  ];
+  return names.filter((name) => input.allowed.includes(name));
+}
+
+/** Whether Site SQL is offered on this deployment and turned on for the Site. */
+export async function siteAgentSiteSqlOn(
+  deps: Pick<ApiRouteDeps, "db" | "settings">,
+  scope: { accountId: string; workspaceId: string },
+  siteId: string,
+): Promise<boolean> {
+  if (!siteSqlOffered(deps.settings)) return false;
+  const database = await getSiteSqlDatabase(deps.db, { ...scope, siteId }).catch(() => null);
+  return database?.enabled === true;
+}
+
+/** The data tools for a new conversation of this viewer on this Site. */
+export async function siteAgentDataToolsForStart(
+  deps: Pick<ApiRouteDeps, "db" | "settings">,
+  scope: { accountId: string; workspaceId: string },
+  siteId: string,
+  viewerKind: SiteRuntimeConversationViewerKind,
+): Promise<FirstPartyMcpToolName[]> {
+  return siteAgentDataToolNames({
+    viewerKind,
+    siteSql: await siteAgentSiteSqlOn(deps, scope, siteId),
+    allowed: resolveFirstPartyMcpToolPolicy(deps.settings).allowed,
+  });
+}
+
+/** This Site's viewer (`user:<subject>` or `guest:<visitor>`) as Site Data and Site SQL see it. */
+export function sitePublishedDataViewer(
+  host: Pick<SiteRuntimeHost, "scope" | "site">,
+  principal: string,
+  guest: boolean,
+): PublishedSiteDataViewer {
+  return {
+    kind: "published_viewer",
+    accountId: host.scope.accountId,
+    workspaceId: host.scope.workspaceId,
+    site: {
+      id: host.site.id,
+      title: host.site.title,
+      status: host.site.status,
+      visibility: host.site.visibility,
+      ownerSubjectId: host.site.ownerSubjectId,
+      createdBySubjectId: host.site.createdBySubjectId,
+    },
+    principal,
+    guest,
+  };
+}
+
+const VIEWER_WORDS: Record<SiteRuntimeConversationViewerKind, string> = {
+  member: "a member of the workspace that owns this Site",
+  invited: "a person invited to this Site from outside the workspace",
+  user: "a signed-in visitor from outside the workspace",
+  guest: "an anonymous visitor",
+};
+
+/**
+ * The Site agent's instructions: which Site and viewer it serves and what its
+ * data tools may do, then the owner's own instructions for the Site.
+ */
+export function siteAgentInstructions(
+  host: Pick<SiteRuntimeHost, "site">,
+  viewer: { kind: SiteRuntimeConversationViewerKind },
+  dataTools: readonly string[],
+  ownerInstructions: string | null | undefined,
+): string {
+  const lines = [
+    `You are the assistant on the published Site "${host.site.title}" (Site id ${host.site.id}). You are talking with ${VIEWER_WORDS[viewer.kind]}.`,
+    dataTools.length > 0
+      ? `Your tools (${dataTools.join(", ")}) work only on this Site: always pass siteId ${host.site.id}. They act as this person, so they see and change only what this person may on the page. When a tool refuses (for example sign_in_required or not_available_for_viewer), tell the person plainly what can't be done here and why.`
+      : "You have no tools: answer from the conversation.",
+    viewer.kind === "member"
+      ? "As a workspace member, this person may also have workspace tools the Site gives its assistant."
+      : "This person is outside the workspace: you can only use this Site's own data for them, never workspace tools or files. If they ask for something else, say plainly that you can't do it here.",
+    "You cannot change the Site, its settings, or how its data is defined, and you have no shell or workspace files.",
+  ];
+  const own = ownerInstructions?.trim();
+  return own ? `${lines.join("\n")}\n\n${own}` : lines.join("\n");
+}
+
+/** A Site agent conversation's data context: the pinned Site and the viewer it acts as. */
+export type SiteAgentDataContext = {
+  kind: "site";
+  siteId: string;
+  viewerKind: SiteRuntimeConversationViewerKind;
+  viewer: PublishedSiteDataViewer;
+  /** The limit profile kind in force (Site SQL limits follow it). */
+  profileKind: SiteLimitProfileKind;
+  /**
+   * Count one write against the guest write limit (anonymous guests only);
+   * null when allowed, else the seconds to wait.
+   */
+  guestWrite: () => Promise<number | null>;
+};
+
+export type SiteAgentDataResolution =
+  | { kind: "ordinary" }
+  | { kind: "refused"; message: string }
+  | SiteAgentDataContext;
+
+/**
+ * Whether an agent session is a published Site's agent and, if so, the Site
+ * and viewer its data tools act for. Ordinary sessions resolve `ordinary`.
+ * A Site agent whose conversation, Site or publication cannot be confirmed,
+ * or whose member viewer has left the workspace, is refused (fail closed).
+ */
+export async function resolveSiteAgentDataContext(
+  deps: Pick<ApiRouteDeps, "db" | "settings" | "objectStorage">,
+  scope: { accountId: string; workspaceId: string },
+  sessionId: string,
+): Promise<SiteAgentDataResolution> {
+  const found = await findSiteRuntimeAgentConversation(deps.db, scope, sessionId);
+  if (!found.siteAgent) return { kind: "ordinary" };
+  const refused = (message: string): SiteAgentDataResolution => ({ kind: "refused", message });
+  const conversation = found.conversation;
+  if (!conversation) return refused("This Site's assistant could not confirm its conversation");
+  const [publication, site] = await Promise.all([
+    getSitePublication(deps.db, scope, conversation.siteId),
+    getPublishedSite(deps.db, scope, conversation.siteId),
+  ]);
+  if (!publication || !site || publication.status !== "active" || !siteServable(site))
+    return refused("This Site is not available");
+  const subjectId = conversation.viewerPrincipal.startsWith("user:")
+    ? conversation.viewerPrincipal.slice("user:".length)
+    : null;
+  if (
+    conversation.viewerKind === "member" &&
+    (!subjectId || !(await isSiteWorkspaceMember(deps.db, scope, subjectId)))
+  )
+    return refused("This conversation's viewer is no longer a workspace member");
+  // Cancellation is only a convenience. Recheck the current audience for every
+  // tool call, using the verified identity retained on the server at start.
+  if (conversation.viewerKind === "guest") {
+    if (!siteGuestsAllowed(publication.access, deps.settings))
+      return refused("This conversation's viewer no longer has access to this Site");
+  } else if (conversation.viewerKind !== "member") {
+    const kind =
+      subjectId &&
+      signedInSiteViewerKind({
+        access: effectiveSiteAccess(publication.access, deps.settings),
+        member: false,
+        email: await siteRuntimeConversationViewerEmail(deps.db, scope, conversation.sessionId),
+        invitedEmails: publication.invitedEmails,
+      });
+    if (!kind) return refused("This conversation's viewer no longer has access to this Site");
+  }
+  const domain = deps.settings.sitesDomain ?? "";
+  const host: SiteRuntimeHost = {
+    domain,
+    label: publication.label,
+    hostname: domain ? siteHostname(publication.label, domain) : publication.label,
+    scope,
+    publication,
+    site,
+  };
+  const guest = conversation.viewerKind === "guest";
+  const profile = await siteRuntimeLimitProfile(deps, host, { kind: conversation.viewerKind });
+  return {
+    kind: "site",
+    siteId: conversation.siteId,
+    viewerKind: conversation.viewerKind,
+    viewer: sitePublishedDataViewer(host, conversation.viewerPrincipal, guest),
+    profileKind: profile.kind,
+    guestWrite: async () => {
+      const limit = profile.limits.guestWritesPerMinute;
+      if (!guest || limit === null) return null;
+      const rate = await consumeSiteRuntimeRate(deps.db, scope, {
+        siteId: conversation.siteId,
+        principal: conversation.viewerPrincipal,
+        bucket: "guest_writes",
+        limit,
+      });
+      return rate.allowed ? null : Math.max(1, rate.retryAfterSeconds);
+    },
+  };
+}

package/src/site-publishing/agent-model.ts

@@ -0,0 +1,127 @@
+import type { Settings } from "@opengeni/config";
+import {
+  resolveWorkspaceSessionDefaults,
+  type OrganizationModelDefaults,
+  type WorkspaceSessionDefaults,
+} from "@opengeni/contracts";
+import {
+  admissibleWorkspaceModel,
+  loadWorkspaceModelSelectionInput,
+  resolveWorkspaceModelSelection,
+  selectDefaultSessionModel,
+  type WorkspaceModelSelection,
+} from "@opengeni/core";
+import { getOrganizationModelDefaults, getWorkspace, type Database } from "@opengeni/db";
+
+/**
+ * The model of a Site agent conversation by who the viewer is.
+ *
+ * People outside the workspace (invited people and public visitors) never
+ * use a subscription-billed model (a connected Codex, Claude or other
+ * subscription): Site limits measure real money, and visitors must not use
+ * up a subscription's rate limits or terms. When the Site agent's model is a
+ * subscription model (or the workspace default it falls back to is one),
+ * they get the workspace's default credit-billed model instead, chosen the
+ * same way as the workspace's ordinary default over the credit-billed models
+ * only. When the workspace has none, they are refused. Workspace members use
+ * the Site agent's model, subscriptions included.
+ */
+export type SiteOutsideModelChoice =
+  /** The Site agent's model (or the workspace default it resolves to), not a subscription. */
+  { kind: "same"; model: string } | { kind: "fallback"; model: string } | { kind: "unavailable" };
+
+/** Whether a model is billed through a subscription rather than credits. */
+export function isSubscriptionBilledModel(
+  selections: readonly WorkspaceModelSelection[],
+  model: string,
+): boolean {
+  const selection = selections.find((candidate) => candidate.model.id === model);
+  if (selection) return selection.model.cost === "subscription";
+  return (
+    model.startsWith("codex/") ||
+    model.startsWith("supergrok/") ||
+    /(^|-)(claude-)?subscription\//u.test(model)
+  );
+}
+
+/** The decision for people outside the workspace, from already-loaded selections. */
+export function siteOutsideModelChoice(input: {
+  settings: Settings;
+  selections: readonly WorkspaceModelSelection[];
+  /** The Site agent's model; null uses the workspace default. */
+  agentModel: string | null;
+  workspaceDefaults: WorkspaceSessionDefaults | null;
+  organizationDefaults: OrganizationModelDefaults["sessionDefaults"] | null;
+}): SiteOutsideModelChoice {
+  const base = {
+    settings: input.settings,
+    workspaceDefaults: input.workspaceDefaults,
+    organizationDefaults: input.organizationDefaults,
+  };
+  const chosen =
+    input.agentModel ??
+    selectDefaultSessionModel({ ...base, selections: input.selections, creditsAvailable: true })
+      .model;
+  // Always the concrete model: a session created without one would take the
+  // workspace's ordinary default, which may be a subscription.
+  // The fallback is paid with credits, as the publish dialog says.
+  const credited = input.selections.filter((selection) => selection.model.cost === "credits");
+  if (
+    admissibleWorkspaceModel(credited, chosen) &&
+    !isSubscriptionBilledModel(input.selections, chosen)
+  )
+    return { kind: "same", model: chosen };
+  const fallback = selectDefaultSessionModel({
+    ...base,
+    selections: credited,
+    creditsAvailable: true,
+  }).model;
+  return admissibleWorkspaceModel(credited, fallback) &&
+    !isSubscriptionBilledModel(input.selections, fallback)
+    ? { kind: "fallback", model: fallback }
+    : { kind: "unavailable" };
+}
+
+/** Actual catalog billing, not just provider-name heuristics, fences every admission. */
+export async function siteCreditModelIds(
+  deps: { db: Database; settings: Settings },
+  scope: { accountId: string; workspaceId: string },
+  siteId: string,
+): Promise<string[]> {
+  const input = await loadWorkspaceModelSelectionInput(deps.db, deps.settings, {
+    ...scope,
+    subjectId: `site:${siteId}`,
+  });
+  return resolveWorkspaceModelSelection(input)
+    .filter(
+      (selection) =>
+        selection.model.cost === "credits" &&
+        admissibleWorkspaceModel([selection], selection.model.id),
+    )
+    .map((selection) => selection.model.id);
+}
+
+/** Load the workspace's model selection and decide for people outside the workspace. */
+export async function resolveSiteOutsideModel(
+  deps: { db: Database; settings: Settings },
+  scope: { accountId: string; workspaceId: string },
+  input: { siteId: string; agentModel: string | null },
+): Promise<SiteOutsideModelChoice> {
+  const [selectionInput, workspace, organization] = await Promise.all([
+    loadWorkspaceModelSelectionInput(deps.db, deps.settings, {
+      accountId: scope.accountId,
+      workspaceId: scope.workspaceId,
+      // The Site's own principal: it holds no personal subscription authority.
+      subjectId: `site:${input.siteId}`,
+    }),
+    getWorkspace(deps.db, scope.workspaceId),
+    getOrganizationModelDefaults(deps.db, scope.accountId),
+  ]);
+  return siteOutsideModelChoice({
+    settings: deps.settings,
+    selections: resolveWorkspaceModelSelection(selectionInput),
+    agentModel: input.agentModel,
+    workspaceDefaults: resolveWorkspaceSessionDefaults(workspace?.settings ?? {}),
+    organizationDefaults: organization.sessionDefaults ?? null,
+  });
+}

package/src/site-publishing/agent-session.ts

@@ -0,0 +1,148 @@
+import { resolveAgentConfig, type SessionToolPolicy, type ToolRef } from "@opengeni/contracts";
+import { agentConfigDeploymentPolicy, resolveFirstPartyMcpToolPolicy } from "@opengeni/config";
+import { siteSessionOriginFromMetadata, type ApiRouteDeps } from "@opengeni/core";
+import { appendSessionEventsWithLockedSessionUpdate, getSiteSqlDatabase } from "@opengeni/db";
+import { publishDurableSessionEvents } from "@opengeni/events";
+import {
+  resolveSiteAgentDataContext,
+  SITE_AGENT_DATA_TOOL_PERMISSIONS,
+  siteAgentDataToolNames,
+  siteAgentInstructions,
+} from "./agent-data-tools";
+import type { SiteRuntimeHost } from "./runtime";
+import type { SiteRuntimeViewer } from "./viewer";
+import { sitePublishingError } from "./service";
+import { siteSqlOffered } from "../site-sql/gateway";
+
+export const SITE_AGENT_DEFAULTS_VERSION = 1;
+
+/**
+ * Before admitting more work, converge pre-redesign published-host sessions to
+ * the same Site-local tools as a new conversation. This is a trusted host
+ * upgrade, not a caller-controlled tool-policy edit. The route has already
+ * checked ownership, current audience, models and the retained connector set;
+ * each data-tool execution still resolves the live viewer independently.
+ *
+ * The session writer lock makes the config, permissions, sandbox, instructions,
+ * audit event and completion marker atomic. Failed writes remain retryable.
+ * Existing attempts keep their accepted execution policy; no turn is rewritten.
+ */
+export async function normalizeSiteAgentSession(
+  deps: Pick<ApiRouteDeps, "db" | "settings" | "bus" | "objectStorage">,
+  host: SiteRuntimeHost,
+  viewer: SiteRuntimeViewer,
+  sessionId: string,
+  retainedToolIds: readonly string[],
+): Promise<void> {
+  const data = await resolveSiteAgentDataContext(deps, host.scope, sessionId);
+  if (
+    data.kind !== "site" ||
+    data.siteId !== host.site.id ||
+    data.viewer.principal !== viewer.principal
+  )
+    throw sitePublishingError(
+      403,
+      "forbidden",
+      "site_conversation_unavailable",
+      "This conversation is not available",
+    );
+  // Do not turn a transient SQL-metadata read failure into a permanently
+  // completed upgrade missing SQL tools. No marker commits on a failed read.
+  const sqlEnabled = siteSqlOffered(deps.settings)
+    ? (await getSiteSqlDatabase(deps.db, { ...host.scope, siteId: host.site.id }))?.enabled === true
+    : false;
+  const dataTools = siteAgentDataToolNames({
+    viewerKind: viewer.kind,
+    siteSql: sqlEnabled,
+    allowed: resolveFirstPartyMcpToolPolicy(deps.settings).allowed,
+  });
+  const config = resolveAgentConfig({
+    creator: "api",
+    request: {
+      capabilities: {
+        from: "none",
+        humanInput: false,
+        skills: false,
+        ...(dataTools.length ? { artifacts: true } : {}),
+      },
+    },
+    workspace: { defaults: null, humanInputEnabled: false },
+    deployment: agentConfigDeploymentPolicy(deps.settings),
+    goal: false,
+  }).config;
+  const instructions = siteAgentInstructions(
+    host,
+    viewer,
+    dataTools,
+    host.publication.agent.instructions,
+  );
+  const events = await appendSessionEventsWithLockedSessionUpdate(
+    deps.db,
+    host.scope.workspaceId,
+    sessionId,
+    (session) => {
+      if (
+        session.parentSessionId ||
+        session.createdBy.subjectId !== `site:${host.site.id}` ||
+        siteSessionOriginFromMetadata(session.metadata)?.siteId !== host.site.id
+      )
+        throw sitePublishingError(
+          403,
+          "forbidden",
+          "site_conversation_unavailable",
+          "This conversation is not available",
+        );
+      const raw = session.metadata.opengeniPublishedSite;
+      const stamp =
+        raw && typeof raw === "object" && !Array.isArray(raw)
+          ? (raw as Record<string, unknown>)
+          : {};
+      if (stamp.agentDefaultsVersion === SITE_AGENT_DEFAULTS_VERSION) return { events: [] };
+      // Never restore workspace defaults or add a newly declared connector to
+      // an old conversation. Preserve only its still-authorized exact refs.
+      const allowed = new Set(["opengeni", ...retainedToolIds]);
+      const tools: ToolRef[] = session.tools.filter((tool) => allowed.has(tool.id));
+      const toolPolicy: SessionToolPolicy = {
+        mode: "explicit",
+        firstPartyMode: "explicit",
+        inheritedFromSessionId: null,
+      };
+      const version = session.toolPolicyVersion + 1;
+      return {
+        events: [
+          {
+            type: "session.agent.updated",
+            payload: {
+              before: session.agent,
+              after: config,
+              instructionsChanged: session.instructions !== instructions,
+              version,
+              effectiveFrom: "next_attempt",
+              reason: "site_agent_defaults",
+              firstPartyMcpTools: dataTools,
+              sandboxBackend: "none",
+            },
+          },
+        ],
+        update: {
+          firstPartyMcpTools: dataTools,
+          firstPartyMcpPermissions: [...SITE_AGENT_DATA_TOOL_PERMISSIONS],
+          agentConfig: config,
+          instructions,
+          tools,
+          toolPolicy,
+          sandboxBackend: "none",
+          toolPolicyVersion: version,
+          expectedToolPolicyVersion: session.toolPolicyVersion,
+          metadata: {
+            ...session.metadata,
+            opengeniPublishedSite: { ...stamp, agentDefaultsVersion: SITE_AGENT_DEFAULTS_VERSION },
+          },
+        },
+      };
+    },
+    { activity: "semantic" },
+  );
+  if (events.length)
+    await publishDurableSessionEvents(deps.bus, host.scope.workspaceId, sessionId, events);
+}