@opengeni/api-router 3.0.1 → 3.1.2

package/src/routes/company-brain.ts

@@ -36,6 +36,7 @@ import { z } from "zod";
 
 import { createCompanyBrainOkfPackage, serializeCompanyBrainOkf } from "../company-brain-okf";
 import { projectWorkspaceState } from "../workspace-state-projection";
+import { USER_CONTENT_SECURITY_HEADERS } from "../http/user-content";
 
 const inspectorQuery = z
   .object({
@@ -235,6 +236,9 @@ export function registerCompanyBrainRoutes(app: Hono, deps: ApiRouteDeps): void
       "content-disposition",
       `attachment; filename="company-brain-${workspaceId}.okf.md"`,
     );
+    for (const [name, value] of Object.entries(USER_CONTENT_SECURITY_HEADERS)) {
+      context.header(name, value);
+    }
     return context.body(serializeCompanyBrainOkf(result));
   });
 

package/src/routes/computer-sessions.ts

@@ -1,15 +1,23 @@
+import { attachedBrowserViewer } from "../attached-browser-viewer";
 import { randomUUID } from "node:crypto";
-import { resolveFirstPartyDelegationSecret, resolveStreamTokenSecret } from "@opengeni/config";
+import {
+  resolveFirstPartyDelegationSecret,
+  resolveStreamTokenSecret,
+  sandboxWarmRateMicrosPerSecond,
+} from "@opengeni/config";
 import {
   BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX,
   BROWSER_CONTROL_PORT,
   COMPUTER_CONTROL_WEBSOCKET_PROTOCOL,
-  COMPUTER_RFB_WEBSOCKET_PROTOCOL,
+  ComputerNativeCommand,
+  ComputerNativeCallRequest,
   ComputerActionCommand,
+  computerActionSecretTexts,
   ComputerActionRequest,
   ComputerSessionAttachment,
   ComputerSessionAttachmentRequest,
   ComputerSessionHeartbeatResponse,
+  ComputerSessionInputPosture,
   ComputerSessionLifecycleRequest,
   ComputerSessionListResponse,
   ComputerSessionMutationResponse,
@@ -32,6 +40,7 @@ import {
   ComputerSessionNotFoundError,
   ComputerSessionOperationConflictError,
   ComputerSessionStateError,
+  SandboxPaidComputeAdmissionError,
   dispatchComputerSessionOperation,
   failComputerSessionOperation,
   findComputerSessionControlRecordByOperation,
@@ -52,9 +61,11 @@ import {
   type LeaseSnapshot,
 } from "@opengeni/db";
 import {
+  hasPermission,
   requireAccessGrant,
   requireSessionAuthorization,
   relayConfigFromSettings,
+  resolveChannelAMachineConnection,
   resolveSessionSandboxRuntime,
   SessionAuthorizationDeniedError,
   SessionAuthorizationUnavailableError,
@@ -97,7 +108,10 @@ import {
   shouldPersistControllerDataPlaneUrl,
   withCachedController,
 } from "../controller-data-plane";
-import { filterInteractionSessionsForGrant } from "../interaction-agent-access";
+import {
+  filterInteractionSessionsForGrant,
+  parseInteractionSessionListQuery,
+} from "../interaction-agent-access";
 import { withInteractionHolderHeartbeat } from "../interaction-holder-heartbeat";
 import { validateInteractionRequestOrigin } from "../http/cors";
 import { ApiHttpError } from "../http/api-error";
@@ -112,12 +126,22 @@ import {
   observeLifecycleResult,
 } from "../interaction-metrics";
 import { withChannelA, withChannelARead, type ChannelAOperation } from "../sandbox/channel-a";
+import { USER_CONTENT_SECURITY_HEADERS } from "../http/user-content";
+import { wrongInteractionPlacementMessage } from "./interaction-placement-message";
+import {
+  collectStringsDeep,
+  resolveInteractionSecretValues,
+  type InteractionSecretsPort,
+} from "../interaction-secrets";
+import { requirePlacementAcceptsSecretValues } from "../interaction-agent-version";
 
 type ComputerPlacement = {
   placement: InteractionPlacement;
   placementInstanceId: string;
   session: BrowserControlPlacementSession;
   lease: LeaseSnapshot | null;
+  /** Current placement consent, separate from passive viewing authority. */
+  screenControlAllowed?: boolean;
 };
 
 const MODEL_COMPUTER_FRAME_MAX_BYTES = 256 * 1024;
@@ -173,10 +197,32 @@ export async function captureModelComputerFrame(
   return captured;
 }
 
+/** One validated screen frame, served as sandboxed, non-embeddable user content. */
+export function computerScreenshotResponse(
+  frame: Pick<ComputerControlFrame, "data" | "mediaType" | "metadataHeader">,
+): Response {
+  // Copy exactly the image bytes: a Node Buffer view may share a larger
+  // backing allocation, which `.slice().buffer` would expose whole.
+  return new Response(Uint8Array.from(frame.data).buffer, {
+    status: 200,
+    headers: {
+      "cache-control": "no-store",
+      "content-type": frame.mediaType,
+      "x-opengeni-computer-frame": frame.metadataHeader,
+      ...USER_CONTENT_SECURITY_HEADERS,
+    },
+  });
+}
+
 /** Public ComputerSession resource surface. Physical app/window authority stays
  * in the same placement controller used by BrowserSession; this route owns only
  * durable authorization, placement fencing, lifecycle receipts, and routing. */
-export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): void {
+export function registerComputerSessionRoutes(
+  app: Hono,
+  deps: ApiRouteDeps,
+  options: { interactionSecrets?: InteractionSecretsPort | null } = {},
+): void {
+  const interactionSecrets = options.interactionSecrets ?? null;
   const channelServices = {
     db: deps.db,
     settings: deps.settings,
@@ -190,6 +236,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     const listed = await listComputerSessions(deps.db, {
       accountId: grant.accountId,
       workspaceId,
+      ...parseInteractionSessionListQuery(context.req.query()),
     });
     return context.json(
       ComputerSessionListResponse.parse({
@@ -224,6 +271,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     await authorizeSourceSession(deps, grant, request.sessionId, "session.control");
     const origin = requestOrigin(context, deps.settings);
     const authority = controllerAuthorityRoot(deps);
+    let prepared: Awaited<ReturnType<typeof prepareComputerSessionCreate>> | null = null;
 
     try {
       const existing = await findComputerSessionControlRecordByOperation(deps.db, {
@@ -237,7 +285,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         );
       }
       if (existing) assertCreateReplay(request, existing.session);
-      let prepared = existing
+      prepared = existing
         ? await prepareComputerSessionCreate(
             deps.db,
             computerCreateInput(grant, workspaceId, request, existing.session.placement),
@@ -403,10 +451,49 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         parsed.operation.state === "completed" && !parsed.operation.replayed ? 201 : 200,
       );
     } catch (error) {
+      if (prepared) {
+        // A concurrent dispatch owns its exact binding, even if this request's
+        // placement failed. Settle only the still-undispatched create receipt.
+        await failComputerSessionOperation(deps.db, {
+          accountId: grant.accountId,
+          workspaceId,
+          operationId: request.operationId,
+          computerSessionId: prepared.session.id,
+          onlyIfPreparedCreate: true,
+          error: interactionFailure(error),
+        }).catch(() => undefined);
+      }
       throw computerRouteError(error);
     }
   });
 
+  app.get(
+    "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/input-posture",
+    async (context) => {
+      const { workspaceId, grant, computerSessionId } = await routePreamble(
+        context,
+        "sessions:read",
+      );
+      const result = await withActiveComputerController(
+        context,
+        grant,
+        workspaceId,
+        computerSessionId,
+        "session.read",
+        "computer.read",
+        async ({ record, binding, placement }) =>
+          ComputerSessionInputPosture.parse({
+            computerSessionId,
+            controllerGeneration: binding.controllerGeneration,
+            inputAllowed: await authorizeHumanFrameInput(grant, record, placement),
+          }),
+        false,
+      );
+      context.header("cache-control", "no-store");
+      return context.json(result);
+    },
+  );
+
   app.get(
     "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets",
     async (context) => {
@@ -483,14 +570,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
           }
         },
       );
-      return new Response(frame.data.slice().buffer, {
-        status: 200,
-        headers: {
-          "cache-control": "no-store",
-          "content-type": frame.mediaType,
-          "x-opengeni-computer-frame": frame.metadataHeader,
-        },
-      });
+      return computerScreenshotResponse(frame);
     },
   );
 
@@ -514,6 +594,68 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     },
   );
 
+  app.post(
+    "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/native-calls",
+    async (context) => {
+      const { workspaceId, grant, computerSessionId } = await routePreamble(
+        context,
+        "sessions:control",
+      );
+      if (grant.principalKind === "agent_attempt") {
+        const selected = grant.metadata?.firstPartyMcpTools;
+        if (!Array.isArray(selected) || !selected.includes("computer_act"))
+          throw new HTTPException(403, {
+            message: "Computer control is not selected for this attempt",
+          });
+      }
+      const request = await parseJsonBody(context, ComputerNativeCallRequest);
+      const result = await withActiveComputerController(
+        context,
+        grant,
+        workspaceId,
+        computerSessionId,
+        "session.control",
+        "computer.action",
+        async ({ sessionClient, binding, record }) => {
+          if (
+            record.session.placement.kind === "sandbox_group" &&
+            deps.settings.sandboxDesktopInteractive === false &&
+            grant.principalKind !== "agent_attempt"
+          )
+            throw new HTTPException(403, { message: "Human desktop input is disabled" });
+          const commandFields = {
+            ...request,
+            protocolVersion: INTERACTION_PROTOCOL_VERSION,
+            computerSessionId,
+            controllerGeneration: binding.controllerGeneration,
+            targetId: null,
+            actor: interactionActorForGrant(grant),
+          };
+          ComputerNativeCommand.parse(commandFields);
+          const secretValues = await resolveInteractionSecretValues({
+            port: interactionSecrets,
+            grant,
+            texts: collectStringsDeep(request.arguments),
+            use: { surface: "desktop", toolName: request.tool, operationId: request.operationId },
+            beforeResolve: requirePlacementAcceptsSecretValues(
+              deps.db,
+              grant,
+              workspaceId,
+              record.session.placement,
+            ),
+          });
+          return await sessionClient.nativeCall(
+            ComputerNativeCommand.parse({
+              ...commandFields,
+              ...(secretValues === undefined ? {} : { secretValues }),
+            }),
+          );
+        },
+      );
+      return context.json(result);
+    },
+  );
+
   app.post(
     "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/actions",
     async (context) => {
@@ -530,21 +672,46 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         computerSessionId,
         "session.control",
         "computer.action",
-        async ({ sessionClient, binding }) =>
-          await sessionClient.action(
+        async ({ sessionClient, binding, record }) => {
+          if (
+            record.session.placement.kind === "sandbox_group" &&
+            deps.settings.sandboxDesktopInteractive === false &&
+            grant.principalKind !== "agent_attempt"
+          ) {
+            throw new HTTPException(403, { message: "Human desktop input is disabled" });
+          }
+          const commandFields = {
+            protocolVersion: INTERACTION_PROTOCOL_VERSION,
+            operationId: request.operationId,
+            computerSessionId,
+            controllerGeneration: binding.controllerGeneration,
+            targetId: request.targetId,
+            expectedTargetGeneration: request.expectedTargetGeneration,
+            expectedObservationId: request.expectedObservationId,
+            expectedFrameId: request.expectedFrameId,
+            actor: interactionActorForGrant(grant),
+            action: request.action,
+          };
+          ComputerActionCommand.parse(commandFields);
+          const secretValues = await resolveInteractionSecretValues({
+            port: interactionSecrets,
+            grant,
+            texts: computerActionSecretTexts(request.action),
+            use: { surface: "desktop", toolName: "computer_act", operationId: request.operationId },
+            beforeResolve: requirePlacementAcceptsSecretValues(
+              deps.db,
+              grant,
+              workspaceId,
+              record.session.placement,
+            ),
+          });
+          return await sessionClient.action(
             ComputerActionCommand.parse({
-              protocolVersion: INTERACTION_PROTOCOL_VERSION,
-              operationId: request.operationId,
-              computerSessionId,
-              controllerGeneration: binding.controllerGeneration,
-              targetId: request.targetId,
-              expectedTargetGeneration: request.expectedTargetGeneration,
-              expectedObservationId: request.expectedObservationId,
-              expectedFrameId: request.expectedFrameId,
-              actor: interactionActorForGrant(grant),
-              action: request.action,
+              ...commandFields,
+              ...(secretValues === undefined ? {} : { secretValues }),
             }),
-          ),
+          );
+        },
       );
       observeComputerActionResult(deps.observability, startedAtMs, request, result);
       return context.json(result);
@@ -623,11 +790,18 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
             grantId,
             expiresAt,
           });
-          await client.createComputerViewGrant(reference, {
+          // Keep the old strict-key request. Human input uses canonical
+          // actions; this grant authorizes only the frame producer. An older
+          // controller's reusable RFB bearer must stay behind the proxy.
+          const viewGrant = await client.createComputerViewGrant(reference, {
             grantId,
             token,
             expiresAt,
           });
+          const managedLinuxPlacement =
+            record.session.placement.kind === "sandbox_group" &&
+            record.session.platform === "linux";
+          const inputAllowed = await authorizeHumanFrameInput(grant, record, placement);
           const relaySecret = placement.session.openComputerFrames
             ? resolveStreamTokenSecret(deps.settings)
             : null;
@@ -695,58 +869,47 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
                 };
               })()
             : await (async () => {
-                const rfb =
-                  record.session.placement.kind === "sandbox_group" &&
-                  record.session.platform === "linux" &&
-                  target.kind === "screen";
-                const protocols = rfb
-                  ? [
-                      "binary",
-                      COMPUTER_RFB_WEBSOCKET_PROTOCOL,
-                      `${BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX}${token}`,
-                    ]
-                  : [
-                      COMPUTER_CONTROL_WEBSOCKET_PROTOCOL,
-                      `${BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX}${token}`,
-                    ];
-                const upstreamUrl = rfb
-                  ? await client.computerRfbStreamUrl(reference, request.targetId)
-                  : await client.computerFrameStreamUrl(
-                      reference,
-                      request.targetId,
-                      request.stream,
-                    );
-                const attachment = placementUsesInteractionFrameProxy(placement.lease?.backend, {
-                  openSandboxSignedEndpoints: deps.settings.openSandboxSignedEndpoints,
-                  ...(typeof deps.settings.openSandboxInteractionFrameProxy === "boolean"
-                    ? {
-                        openSandboxInteractionFrameProxy:
-                          deps.settings.openSandboxInteractionFrameProxy,
-                      }
-                    : {}),
-                })
-                  ? createInteractionFrameProxyAttachment({
-                      requestUrl: context.req.url,
-                      publicBaseUrl: deps.settings.publicBaseUrl,
-                      webBaseUrl: deps.settings.webBaseUrl,
-                      forwardedProto: context.req.header("x-forwarded-proto"),
-                      forwardedHost:
-                        context.req.header("x-forwarded-host") ?? context.req.header("host"),
-                      rootSecret: controllerAuthorityRoot(deps),
-                      upstreamUrl,
-                      upstreamProtocols: protocols,
-                      origin,
-                      expiresAt,
-                    })
-                  : { url: upstreamUrl, protocols };
-                return rfb
-                  ? { kind: "direct_rfb" as const, ...attachment }
-                  : { kind: "direct_websocket" as const, ...attachment };
+                const protocols = [
+                  COMPUTER_CONTROL_WEBSOCKET_PROTOCOL,
+                  `${BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX}${token}`,
+                ];
+                const upstreamUrl = await client.computerFrameStreamUrl(
+                  reference,
+                  request.targetId,
+                  request.stream,
+                );
+                const attachment =
+                  (!viewGrant.scopedRfbInput && managedLinuxPlacement) ||
+                  placementUsesInteractionFrameProxy(placement.lease?.backend, {
+                    openSandboxSignedEndpoints: deps.settings.openSandboxSignedEndpoints,
+                    ...(typeof deps.settings.openSandboxInteractionFrameProxy === "boolean"
+                      ? {
+                          openSandboxInteractionFrameProxy:
+                            deps.settings.openSandboxInteractionFrameProxy,
+                        }
+                      : {}),
+                  })
+                    ? createInteractionFrameProxyAttachment({
+                        requestUrl: context.req.url,
+                        publicBaseUrl: deps.settings.publicBaseUrl,
+                        webBaseUrl: deps.settings.webBaseUrl,
+                        forwardedProto: context.req.header("x-forwarded-proto"),
+                        forwardedHost:
+                          context.req.header("x-forwarded-host") ?? context.req.header("host"),
+                        rootSecret: controllerAuthorityRoot(deps),
+                        upstreamUrl,
+                        upstreamProtocols: protocols,
+                        origin,
+                        expiresAt,
+                      })
+                    : { url: upstreamUrl, protocols };
+                return { kind: "direct_websocket" as const, ...attachment };
               })();
           return ComputerSessionAttachment.parse({
             computerSessionId,
             controllerGeneration: binding.controllerGeneration,
             targetId: request.targetId,
+            inputAllowed,
             stream,
             expiresAt,
           });
@@ -756,6 +919,40 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     },
   );
 
+  async function authorizeHumanFrameInput(
+    grant: AccessGrant,
+    record: ComputerSessionControlRecord,
+    placement: ComputerPlacement,
+  ): Promise<boolean> {
+    if (
+      ((record.session.placement.kind === "connected_machine" ||
+        record.session.placement.kind === "attached_device") &&
+        placement.screenControlAllowed !== true) ||
+      (record.session.placement.kind === "sandbox_group" &&
+        deps.settings.sandboxDesktopInteractive === false) ||
+      grant.principalKind === "agent_attempt" ||
+      !hasPermission(grant.permissions, "sessions:control")
+    )
+      return false;
+    try {
+      await requireSessionAuthorization(deps, grant, {
+        sessionId: record.sourceSessionId,
+        operation: "session.control",
+        surface: "http",
+      });
+      return true;
+    } catch (error) {
+      // Input availability cannot invalidate an independently authorized view.
+      // Every action reauthorizes the live source instead of trusting this hint.
+      if (
+        error instanceof SessionAuthorizationDeniedError ||
+        error instanceof SessionAuthorizationUnavailableError
+      )
+        return false;
+      throw error;
+    }
+  }
+
   app.post(
     "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/heartbeat",
     async (context) => {
@@ -936,19 +1133,16 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     }
     if (expectedPlacement?.kind === "attached_device") {
       waitSignal.throwIfAborted();
+      // Personal machines are controlled only for their owner, as everywhere else.
+      const viewer = await attachedBrowserViewer(deps, grant, sourceSession.workspaceId);
       const device = await getAttachedBrowserDevice(deps.db, {
-        accountId: grant.accountId,
-        workspaceId: sourceSession.workspaceId,
+        ...viewer,
         deviceId: expectedPlacement.deviceId,
       });
       if (device.state !== "connected") {
         throw new ComputerSessionStateError("Attached browser machine is disconnected");
       }
-      const enrollment = await getLiveEnrollmentConnection(
-        deps.db,
-        sourceSession.workspaceId,
-        device.enrollmentId,
-      );
+      const enrollment = await getLiveEnrollmentConnection(deps.db, viewer, device.enrollmentId);
       if (!enrollment || enrollment.status !== "active" || !enrollment.connectionInstanceId) {
         throw new ComputerSessionStateError("Attached browser machine is unavailable");
       }
@@ -998,6 +1192,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         placementInstanceId,
         session: built.session as unknown as BrowserControlPlacementSession,
         lease: null,
+        screenControlAllowed: enrollment.allowScreenControl === true,
       });
     }
     const runWithChannelA =
@@ -1014,9 +1209,13 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         workspaceId: sourceSession.workspaceId,
         session: sourceSession,
         subjectId: grant.subjectId,
+        grant,
         waitSignal,
         operation,
         retryControllerTransport: operation === "computer.read" || operation === "computer.action",
+        ...(expectedPlacementInstanceId && expectedPlacement?.kind === "sandbox_group"
+          ? { retainedInstanceId: expectedPlacementInstanceId }
+          : {}),
       },
       async (handle) => {
         if (expectedPlacement?.kind === "sandbox_group") {
@@ -1036,26 +1235,51 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         }
 
         const resolved = await handle.routingSession.prime();
+        let screenControlAllowed = false;
         if (operation !== "computer.end" && resolved.kind === "selfhosted" && resolved.sandboxId) {
-          const sandbox = await getSandbox(deps.db, grant, resolved.sandboxId);
+          // Look the routed machine up as the routing did: an agent acts for
+          // the person who started its turn, so a personal (Only me) machine
+          // stays reachable, subject to that attempt's per-chat permission.
+          const machineAuthority = await handle.machineAuthority();
+          const sandbox = await getSandbox(
+            deps.db,
+            {
+              accountId: grant.accountId,
+              workspaceId: sourceSession.workspaceId,
+              subjectId: machineAuthority.subjectId,
+            },
+            resolved.sandboxId,
+          );
           if (sandbox?.kind !== "selfhosted" || !sandbox.enrollmentId) {
             throw new ComputerSessionStateError("Connected Machine placement is unavailable");
           }
-          const enrollment = await getLiveEnrollmentConnection(
+          const enrollment = await resolveChannelAMachineConnection(
             deps.db,
-            grant,
-            sandbox.enrollmentId,
+            {
+              accountId: grant.accountId,
+              workspaceId: sourceSession.workspaceId,
+              sessionId: sourceSession.id,
+              machineWorkspaceId: sandbox.workspaceId,
+              enrollmentId: sandbox.enrollmentId,
+            },
+            machineAuthority,
           );
           if (!enrollment?.connectionInstanceId) {
             throw new ComputerSessionStateError("Connected Machine is unavailable");
           }
           assertConnectedMachineComputerAccess(enrollment, operation);
+          screenControlAllowed = enrollment.allowScreenControl === true;
         }
         if (expectedPlacement?.kind === "connected_machine") {
           if (
             resolved.kind !== "selfhosted" ||
             resolved.sandboxId !== expectedPlacement.sandboxId
           ) {
+            if (operation === "computer.create") {
+              throw new HTTPException(422, {
+                message: wrongInteractionPlacementMessage(expectedPlacement.sandboxId),
+              });
+            }
             return await throwComputerSourcePlacementChanged(
               grant,
               sourceSession.id,
@@ -1069,6 +1293,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
             placementInstanceId,
             session: resolved.session as unknown as BrowserControlPlacementSession,
             lease: null,
+            screenControlAllowed,
           });
         }
         if (resolved.sandboxId === null) {
@@ -1100,6 +1325,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
             placementInstanceId: resolved.providerInstanceId ?? resolved.sandboxId,
             session: resolved.session as unknown as BrowserControlPlacementSession,
             lease: null,
+            screenControlAllowed,
           });
         }
         throw new BrowserControlUnsupportedError(
@@ -1411,6 +1637,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
       deps.db,
       deps.settings,
       sourceSession,
+      { grant },
     );
     const acquired = await acquireLease(deps.db, {
       accountId: grant.accountId,
@@ -1420,8 +1647,13 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
       holderId: interactionHolderId(computerSessionId),
       subjectId: sourceSession.id,
       backend: placement.lease.backend,
+      warmBilling: {
+        mode: deps.settings.sandboxWarmBillingMode,
+        rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond(deps.settings, placement.lease.backend),
+      },
       os: placement.lease.os,
       image: sandboxRuntime.image,
+      imagePolicy: "new_creates_only",
       rigVersionId: sourceSession.rigVersionId,
       leaseTtlMs: deps.settings.sandboxLeaseTtlMs,
       expectedEpoch: placement.lease.leaseEpoch,
@@ -1875,6 +2107,8 @@ function computerRouteError(error: unknown): HTTPException {
   const connectedMachineError = interactionControlApiError(error, "computer");
   if (connectedMachineError) return connectedMachineError;
   if (error instanceof HTTPException) return error;
+  if (error instanceof SandboxPaidComputeAdmissionError)
+    return new HTTPException(402, { message: error.message, cause: error });
   if (error instanceof ComputerSessionNotFoundError) {
     return new HTTPException(404, { message: error.message, cause: error });
   }