@opengeni/api-router 3.2.2 → 3.3.0

package/dist/{chunk-PQBHZ2YH.js → chunk-6CECHDZP.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OGQDXVXY.js";
 
 // src/app.ts
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 
 // src/routes/claude-subscription-accounts.ts
 import { createHmac as createHmac2 } from "crypto";
@@ -4435,7 +4435,7 @@ import {
   setMcpOAuthRequestOrganizationAccess
 } from "@opengeni/db";
 import {
-  hasPermission as hasPermission14,
+  hasPermission as hasPermission15,
   requireAccessContext as requireAccessContext2,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization6
 } from "@opengeni/core";
@@ -4631,7 +4631,7 @@ import {
   buildApiIntegrationMcpServers,
   expandApiIntegrationAccountRoutes,
   expandMcpAccountRoutes,
-  hasPermission as hasPermission13,
+  hasPermission as hasPermission14,
   externalActorContinuationForAuthorization as externalActorContinuationForAuthorization5,
   isVerifiedOrganizationServiceAuthorization as isVerifiedOrganizationServiceAuthorization2,
   externalContinuationCommitAuthorizer,
@@ -7916,9 +7916,11 @@ async function deleteSiteDataFile(deps, grant, siteId3, fileId, surface3 = {}) {
 
 // src/site-publishing/agent-data-tools.ts
 import {
-  siteHostname as siteHostname3
+  siteHostname as siteHostname3,
+  permissionsRequiredByFirstPartyTools
 } from "@opengeni/contracts";
 import { resolveFirstPartyMcpToolPolicy } from "@opengeni/config";
+import { hasPermission as hasPermission5 } from "@opengeni/core";
 import {
   consumeSiteRuntimeRate as consumeSiteRuntimeRate2,
   findSiteRuntimeAgentConversation,
@@ -8033,7 +8035,10 @@ import {
   siteHostname as siteHostname2,
   SITE_NOT_AVAILABLE_FOR_VIEWER_ERROR_CODE
 } from "@opengeni/contracts";
-import { sessionUsageLimitsProducerEnabled } from "@opengeni/core";
+import {
+  sessionUsageLimitsProducerEnabled,
+  stampSiteViewerSessionAuthorization
+} from "@opengeni/core";
 import {
   consumeSiteRuntimeRate,
   findSiteHostname,
@@ -8056,6 +8061,15 @@ import {
   withWorkspaceSessionActivityRls
 } from "@opengeni/db";
 
+// src/site-publishing/session-request-authority.ts
+var authorities = /* @__PURE__ */ new WeakMap();
+function bindSiteSessionRequestAuthority(request, reauthorize) {
+  authorities.set(request, reauthorize);
+}
+async function reauthorizeSiteSessionRequest(request) {
+  await authorities.get(request)?.();
+}
+
 // src/site-publishing/limits.ts
 import {
   DEFAULT_SITE_LIMITS,
@@ -8251,6 +8265,7 @@ function storedSiteLimitProfileKind(kind) {
 
 // src/site-publishing/service.ts
 import { randomBytes as randomBytes2 } from "crypto";
+import { AsyncLocalStorage } from "async_hooks";
 import {
   normalizeSitesDomain,
   OPENGENI_API_CONTRACT_HEADER,
@@ -8282,7 +8297,7 @@ import {
   readSiteRuntimeUsage,
   recordSitePublicationScan,
   getPublishedSite as getPublishedSite2,
-  listActiveSiteRuntimeConversations,
+  listSiteRuntimeCancellationCandidates,
   revokeSiteViewerSessions,
   SitePublishingError,
   SITE_RUNTIME_SITE_PRINCIPAL,
@@ -10014,12 +10029,9 @@ async function runSitePublishing(fn) {
 var SITE_EFFECT_CONCURRENCY = 4;
 var SITE_EFFECT_QUEUE_LIMIT = 2e3;
 var effectsBySettings = /* @__PURE__ */ new WeakMap();
-var dispatchBySettings = /* @__PURE__ */ new WeakMap();
-function setSitePublishingDispatch(settings, dispatch) {
-  dispatchBySettings.set(settings, dispatch);
-}
-function sitePublishingDispatch(settings) {
-  return dispatchBySettings.get(settings) ?? null;
+var cancellationBySettings = /* @__PURE__ */ new WeakMap();
+function setSitePublishingCancellation(settings, cancel) {
+  cancellationBySettings.set(settings, cancel);
 }
 function createEffects(settings, options = {}) {
   const queueLimit = options.queueLimit ?? SITE_EFFECT_QUEUE_LIMIT;
@@ -10297,14 +10309,18 @@ async function siteServiceSessionRequest(deps, scope, site, input) {
     "x-opengeni-site-id": site.id
   });
   if (site.versionId) headers.set("x-opengeni-site-version", site.versionId);
-  if (input.body !== void 0) headers.set("content-type", "application/json");
+  const body5 = input.body === void 0 ? void 0 : JSON.stringify(input.body);
+  if (body5 !== void 0) {
+    headers.set("content-type", "application/json");
+    headers.set("content-length", String(Buffer.byteLength(body5)));
+  }
   return new Request(new URL(input.path, input.origin), {
     method: input.method,
     headers,
-    ...input.body === void 0 ? {} : { body: JSON.stringify(input.body) }
+    ...body5 === void 0 ? {} : { body: body5 }
   });
 }
-var STOP_CONVERSATIONS_LIMIT = 200;
+var STOP_CONVERSATIONS_PAGE_SIZE = 200;
 async function stopSiteViewers(deps, scope, siteId3, options) {
   let revokedSessions = 0;
   if (options.revokeSessions !== false) {
@@ -10318,67 +10334,53 @@ async function stopSiteViewers(deps, scope, siteId3, options) {
     }
   }
   if (options.cancelConversations === false) return { revokedSessions };
-  const dispatch = sitePublishingDispatch(deps.settings);
-  if (!dispatch) {
-    console.warn("[site-publishing] conversation cancel skipped: no in-process dispatch", {
+  const cancel = cancellationBySettings.get(deps.settings);
+  if (!cancel) {
+    console.warn("[site-publishing] conversation cancel unavailable: no lifecycle adapter", {
       siteId: siteId3
     });
     return { revokedSessions };
   }
   const effects = sitePublishingEffects(deps.settings);
-  const origin = deps.settings.publicBaseUrl ?? "http://localhost";
-  effects.schedule("cancel conversations", async () => {
-    const sessionIds = await listActiveSiteRuntimeConversations(deps.db, scope, {
-      siteId: siteId3,
-      limit: STOP_CONVERSATIONS_LIMIT,
-      ...options.toolsNarrowedTo ? { toolsNarrowedTo: options.toolsNarrowedTo } : {}
-    });
-    if (sessionIds.length === 0) return;
-    const versionId = (await getPublishedSite2(deps.db, scope, siteId3))?.currentVersionId ?? null;
-    if (!versionId) {
-      console.warn("[site-publishing] conversation cancel skipped: the Site has no version", {
-        siteId: siteId3
+  const runInContext = AsyncLocalStorage.snapshot();
+  const operation = crypto.randomUUID();
+  const startedBefore = /* @__PURE__ */ new Date();
+  const run2 = () => runInContext(async () => {
+    let after;
+    let failed = 0;
+    for (; ; ) {
+      const sessionIds = await listSiteRuntimeCancellationCandidates(deps.db, scope, {
+        siteId: siteId3,
+        limit: STOP_CONVERSATIONS_PAGE_SIZE,
+        startedBefore,
+        ...after ? { after } : {},
+        ...options.toolsNarrowedTo ? { toolsNarrowedTo: options.toolsNarrowedTo } : {}
       });
-      return;
-    }
-    const operation = crypto.randomUUID();
-    for (const sessionId of sessionIds) {
-      try {
-        const response = await dispatch(
-          await siteServiceSessionRequest(
-            deps,
-            scope,
-            { id: siteId3, versionId },
-            {
-              origin,
-              method: "POST",
-              path: `/v1/workspaces/${scope.workspaceId}/sessions/${sessionId}/control`,
-              body: {
-                action: "cancel",
-                clientEventId: `site-stop:${operation}:${sessionId}`.slice(0, 200),
-                reason: options.reason.slice(0, 500)
-              },
-              label: "Published Site"
-            }
-          )
-        );
-        if (!response.ok)
+      if (sessionIds.length === 0) break;
+      for (const sessionId of sessionIds) {
+        try {
+          await cancel({
+            ...scope,
+            siteId: siteId3,
+            sessionId,
+            operationKey: `site-stop:${operation}:${sessionId}`,
+            reason: options.reason.slice(0, 500)
+          });
+        } catch (error) {
+          failed += 1;
           console.warn("[site-publishing] could not cancel a Site conversation", {
             siteId: siteId3,
             sessionId,
-            status: response.status,
-            body: (await response.text().catch(() => "")).slice(0, 300)
+            error: error instanceof Error ? error.message : String(error)
           });
-        else await response.body?.cancel().catch(() => void 0);
-      } catch (error) {
-        console.warn("[site-publishing] could not cancel a Site conversation", {
-          siteId: siteId3,
-          sessionId,
-          error: error instanceof Error ? error.message : String(error)
-        });
+        }
       }
+      after = sessionIds.at(-1);
     }
+    if (failed > 0)
+      throw new Error(`Site lifecycle cancellation failed for ${failed} conversations`);
   });
+  if (!effects.schedule("cancel conversations", run2)) await run2();
   return { revokedSessions };
 }
 var abuseNoticeHours = /* @__PURE__ */ new Map();
@@ -11192,12 +11194,24 @@ async function meterSiteRuntime(deps, host, event) {
   }
 }
 async function siteRuntimeSessionRequest(deps, host, viewer, input) {
-  return await siteServiceSessionRequest(
+  const request = await siteServiceSessionRequest(
     deps,
     host.scope,
     { id: host.site.id, versionId: host.versionId },
     { ...input, label: `${siteRuntimeViewerLabel(viewer)} on ${host.hostname}` }
   );
+  bindSiteSessionRequestAuthority(request, input.reauthorize);
+  if (viewer.kind === "member" && viewer.subjectId && viewer.sessionId) {
+    stampSiteViewerSessionAuthorization(request, {
+      organizationId: host.scope.accountId,
+      subjectId: viewer.subjectId,
+      permissions: [
+        .../* @__PURE__ */ new Set([...SITE_RUNTIME_AGENT_PERMISSIONS, ...input.extraPermissions ?? []])
+      ],
+      workspaceId: host.scope.workspaceId
+    });
+  }
+  return request;
 }
 function siteRuntimeForwardedResponse(response) {
   const headers = new Headers(response.headers);
@@ -11217,10 +11231,6 @@ var SITE_AGENT_SQL_TOOLS = Object.freeze([
 var SITE_AGENT_MEMBER_SQL_TOOLS = Object.freeze([
   "site_sql_query"
 ]);
-var SITE_AGENT_DATA_TOOL_PERMISSIONS = Object.freeze([
-  "artifacts:read",
-  "artifacts:publish"
-]);
 var SITE_AGENT_OTHER_SITE_MESSAGE2 = "This Site's assistant can only use this Site's data";
 var SITE_AGENT_MANAGEMENT_MESSAGE = "This Site's assistant can use the Site's data, not manage the Site";
 function siteAgentDataToolNames(input) {
@@ -11229,18 +11239,23 @@ function siteAgentDataToolNames(input) {
     ...input.siteSql ? SITE_AGENT_SQL_TOOLS : [],
     ...input.siteSql && input.viewerKind === "member" ? SITE_AGENT_MEMBER_SQL_TOOLS : []
   ];
-  return names.filter((name) => input.allowed.includes(name));
+  return names.filter(
+    (name) => input.allowed.includes(name) && (input.viewerKind !== "member" || input.memberPermissions === void 0 || permissionsRequiredByFirstPartyTools([name]).every(
+      (permission) => hasPermission5(input.memberPermissions, permission)
+    ))
+  );
 }
 async function siteAgentSiteSqlOn(deps, scope, siteId3) {
   if (!siteSqlOffered(deps.settings)) return false;
   const database = await getSiteSqlDatabase2(deps.db, { ...scope, siteId: siteId3 }).catch(() => null);
   return database?.enabled === true;
 }
-async function siteAgentDataToolsForStart(deps, scope, siteId3, viewerKind) {
+async function siteAgentDataToolsForStart(deps, scope, siteId3, viewerKind, memberPermissions) {
   return siteAgentDataToolNames({
     viewerKind,
     siteSql: await siteAgentSiteSqlOn(deps, scope, siteId3),
-    allowed: resolveFirstPartyMcpToolPolicy(deps.settings).allowed
+    allowed: resolveFirstPartyMcpToolPolicy(deps.settings).allowed,
+    ...memberPermissions === void 0 ? {} : { memberPermissions }
   });
 }
 function sitePublishedDataViewer(host, principal, guest) {
@@ -12533,7 +12548,7 @@ import {
   editableArtifactId,
   editableArtifactReplicaId,
   editableArtifactScope,
-  hasPermission as hasPermission5,
+  hasPermission as hasPermission6,
   requireAccessGrant as requireAccessGrant10,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization2,
   externalActorContinuationForAuthorization as externalActorContinuationForAuthorization2,
@@ -12606,6 +12621,7 @@ async function withAccessGrantSessionRlsContext(deps, grant, fn) {
         {
           subjectId: actor.subjectId,
           initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
+          agentRootSessionId: actor.callerRootSessionId,
           privateFileOwnerSubjectId: learning.defaultScope === "personal" ? learning.subjectId : null
         },
         fn
@@ -12846,7 +12862,7 @@ function registerEditableArtifactRoutes(app, deps) {
   app.post(`${collection}/imports`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const grant = await requireAccessGrant10(context, deps, workspaceId, "artifacts:publish");
-    if (!hasPermission5(grant.permissions, "files:read")) {
+    if (!hasPermission6(grant.permissions, "files:read")) {
       throw applicationHttpError("forbidden");
     }
     const body5 = await parseBoundedImportRequest(context);
@@ -12943,7 +12959,7 @@ function registerEditableArtifactRoutes(app, deps) {
         snapshotVersion: body5.snapshotVersion,
         commandProtocolVersion: body5.commandProtocolVersion,
         committedTransactionProtocolVersion: body5.committedTransactionProtocolVersion,
-        allowEdit: hasPermission5(grant.permissions, "artifacts:publish"),
+        allowEdit: hasPermission6(grant.permissions, "artifacts:publish"),
         ...body5.sourceSessionId ? {
           sourceSessionAuthority: {
             sessionId: body5.sourceSessionId,
@@ -12970,7 +12986,7 @@ function registerEditableArtifactRoutes(app, deps) {
               permissions: [
                 "sessions:read",
                 "artifacts:read",
-                ...hasPermission5(grant.permissions, "artifacts:publish") ? ["artifacts:publish"] : []
+                ...hasPermission6(grant.permissions, "artifacts:publish") ? ["artifacts:publish"] : []
               ]
             },
             ...externalContinuation ? { externalContinuation } : {}
@@ -13896,7 +13912,7 @@ import {
   createWorkspaceVaultProviderRegistry,
   createRemoteExternalVaultFactories,
   externalActorContinuationForAuthorization as externalActorContinuationForAuthorization4,
-  hasPermission as hasPermission6,
+  hasPermission as hasPermission7,
   isVaultError,
   VaultError,
   providerSecretName,
@@ -14223,8 +14239,8 @@ function isAccountAdmin(authorization) {
 }
 function canManageOnePasswordConnection(authorization, connection, metadata) {
   const { grant } = authorization;
-  if (!hasPermission6(grant.permissions, "connections:write", grant.permissionMode)) return false;
-  if (!hasPermission6(grant.permissions, "secrets:write", grant.permissionMode)) return false;
+  if (!hasPermission7(grant.permissions, "connections:write", grant.permissionMode)) return false;
+  if (!hasPermission7(grant.permissions, "secrets:write", grant.permissionMode)) return false;
   if (connection.subjectId !== null) return connection.subjectId === grant.subjectId;
   if (metadata.ownership === "organization") return isAccountAdmin(authorization);
   return true;
@@ -15075,7 +15091,7 @@ function registerVaultProviderRoutes(app, deps, options = {}) {
   }
   function canManageExternal(authorization, connection, details) {
     const grant = authorization.grant;
-    return hasPermission6(grant.permissions, "connections:write", grant.permissionMode) && hasPermission6(grant.permissions, "secrets:write", grant.permissionMode) && (connection.subjectId !== null ? connection.subjectId === grant.subjectId && isPersonalConnectionOwnerPrincipal(authorization) : details.ownership !== "organization" || isAccountAdmin(authorization));
+    return hasPermission7(grant.permissions, "connections:write", grant.permissionMode) && hasPermission7(grant.permissions, "secrets:write", grant.permissionMode) && (connection.subjectId !== null ? connection.subjectId === grant.subjectId && isPersonalConnectionOwnerPrincipal(authorization) : details.ownership !== "organization" || isAccountAdmin(authorization));
   }
   function catalogVault(provider, vault, linkedVaultId) {
     return {
@@ -15803,12 +15819,12 @@ import { isVaultError as isVaultError3, vaultErrorFromDatabase as vaultErrorFrom
 // src/mcp/first-party-tool-permissions.ts
 import {
   FIRST_PARTY_TOOL_AUTHORIZATION,
-  permissionsRequiredByFirstPartyTools
+  permissionsRequiredByFirstPartyTools as permissionsRequiredByFirstPartyTools2
 } from "@opengeni/contracts";
 
 // src/mcp/server.ts
 import {
-  hasPermission as hasPermission10,
+  hasPermission as hasPermission11,
   authorizedSocialConnectionsForGrant,
   buildCapabilityCatalog,
   CONNECTED_MACHINE_CAPABILITY_ID,
@@ -16032,10 +16048,10 @@ async function listWorkspaceGitHubRepositoryBranches(deps, input, services = wor
 }
 
 // src/github-browser-flow.ts
-import { hasPermission as hasPermission7 } from "@opengeni/core";
+import { hasPermission as hasPermission8 } from "@opengeni/core";
 var githubBrowserGrantMaxAgeSeconds = 10 * 60;
 function githubBrowserGrantClaims(settings, grant, nowSeconds = Math.floor(Date.now() / 1e3)) {
-  if (settings.productAccessMode !== "configured" || !hasPermission7(grant.permissions, "github:manage")) {
+  if (settings.productAccessMode !== "configured" || !hasPermission8(grant.permissions, "github:manage")) {
     return {};
   }
   return {
@@ -16773,7 +16789,7 @@ async function withChannelAOperation(services, ctx, readOnly, fn) {
       hasGitHubRepositorySelection(session.resources) ? githubAppBotIdentity(settings) : null
     );
   }
-  const runEstablished = async (routed, lease, homeSession) => {
+  const runEstablished = async (routed, lease, homeSession, pinnedMachine = null) => {
     const emit = async (events) => {
       await appendAndPublishEvents2(
         db,
@@ -16804,6 +16820,7 @@ async function withChannelAOperation(services, ctx, readOnly, fn) {
       homeSession,
       routingSession,
       machineAuthority,
+      pinnedMachine,
       requestId
     });
     await routingSession.finalizeOpStreamOps().catch(() => void 0);
@@ -16892,6 +16909,7 @@ async function withChannelAOperation(services, ctx, readOnly, fn) {
         operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
         transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+        browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
         ...settings.agentOpStreamEnabled === true && enrollment?.opStream === true && bus.getOpStreamConnection ? {
           opStream: {
             transport: new NatsOpStreamTransport(
@@ -16930,7 +16948,11 @@ async function withChannelAOperation(services, ctx, readOnly, fn) {
         },
         established2
       );
-      return await runEstablished(routed, null, established2.session);
+      return await runEstablished(routed, null, established2.session, {
+        sandboxId: sandbox.id,
+        sandboxWorkspaceId: originWorkspaceId,
+        enrollment
+      });
     } catch (error) {
       observeChannelAOperationFailure(services, {
         workspaceId,
@@ -21275,7 +21297,7 @@ import { parseSocialOauthClientsJson } from "@opengeni/config";
 import {
   OAuthStartResponse as OAuthStartResponse2
 } from "@opengeni/contracts";
-import { hasPermission as hasPermission8, requireEnvironmentEncryption as requireEnvironmentEncryption5 } from "@opengeni/core";
+import { hasPermission as hasPermission9, requireEnvironmentEncryption as requireEnvironmentEncryption5 } from "@opengeni/core";
 import {
   consumeIntegrationOAuthStateNonce as consumeIntegrationOAuthStateNonce2,
   decryptEnvironmentValue as decryptEnvironmentValue2,
@@ -21445,7 +21467,7 @@ async function completeSocialOAuthCallback(deps, input) {
       throw new HTTPException28(422, { message: PERSONAL_CONNECTION_PRINCIPAL_MESSAGE });
     }
     const grant = await getWorkspaceGrant2(db, state.subjectId, state.workspaceId);
-    if (!grant || grant.accountId !== state.accountId || state.ownership === "workspace" && !hasPermission8(grant.permissions, "workspace:admin")) {
+    if (!grant || grant.accountId !== state.accountId || state.ownership === "workspace" && !hasPermission9(grant.permissions, "workspace:admin")) {
       throw new HTTPException28(403, {
         message: "OAuth subject no longer has permission to connect social accounts"
       });
@@ -27708,7 +27730,7 @@ import {
 } from "@opengeni/contracts";
 import {
   fileOwnerContextForAgent as fileOwnerContextForAgent3,
-  hasPermission as hasPermission9,
+  hasPermission as hasPermission10,
   requireOpenGeniSlackBotConnection as requireOpenGeniSlackBotConnection2,
   requirePermission as requirePermission3
 } from "@opengeni/core";
@@ -28007,7 +28029,7 @@ async function uploadSlackTaskFile(deps, input) {
   });
 }
 function slackTaskRequesterCanReceiveFile(permissions) {
-  return hasPermission9(permissions, "files:read") && hasPermission9(permissions, "sessions:read");
+  return hasPermission10(permissions, "files:read") && hasPermission10(permissions, "sessions:read");
 }
 function assertSlackTaskUploadTarget(interaction) {
   if (interaction.visibility === "private" && (!interaction.slackChannelId.startsWith("D") || interaction.routeKey !== `${interaction.slackChannelId}:${interaction.slackThreadTs}` || interaction.ackSlackMessageTs !== null && interaction.ackSlackMessageTs !== interaction.slackThreadTs)) {
@@ -43299,7 +43321,7 @@ var PolicyMcpServer = class extends McpServer3 {
   holdsSelectableTool(toolName) {
     const policy = FIRST_PARTY_TOOL_AUTHORIZATION[toolName];
     if (policy.adminAccessRequired) return false;
-    const authorized = (policy.allOf?.every((permission) => hasPermission10(this.grant.permissions, permission)) ?? true) && (policy.anyOf?.some((permission) => hasPermission10(this.grant.permissions, permission)) ?? true);
+    const authorized = (policy.allOf?.every((permission) => hasPermission11(this.grant.permissions, permission)) ?? true) && (policy.anyOf?.some((permission) => hasPermission11(this.grant.permissions, permission)) ?? true);
     return authorized && (this.selectedTools === null || this.selectedTools.has(toolName));
   }
   registerTool(name, config, cb) {
@@ -43407,7 +43429,7 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
   const json2 = (value) => ({
     content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
   });
-  const can = (permission) => hasPermission10(grant.permissions, permission);
+  const can = (permission) => hasPermission11(grant.permissions, permission);
   let socialConnectionsPromise;
   const authorizedSocialConnections = () => socialConnectionsPromise ??= authorizedSocialConnectionsForGrant({
     db: deps.db,
@@ -48524,7 +48546,7 @@ function registerGitHubConnectTool(server, deps, grant, options, json2) {
       const installations = await listWorkspaceGitHubInstallationBindings(deps, grant.workspaceId);
       const status = githubBindingStatus(true, installations);
       const baseUrl = githubBrowserBaseUrl(settings, options.requestOrigin);
-      const state = baseUrl && hasPermission10(grant.permissions, "github:manage") ? createSignedState7(deps.githubStateSecret, {
+      const state = baseUrl && hasPermission11(grant.permissions, "github:manage") ? createSignedState7(deps.githubStateSecret, {
         accountId: grant.accountId,
         workspaceId: grant.workspaceId,
         intent: "installation_authority",
@@ -49065,18 +49087,18 @@ function startWorkspaceToolGatewayObservation(observability, input) {
 }
 
 // src/workspace-tool-gateway-secrets.ts
-import { AsyncLocalStorage } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes5 } from "@opengeni/config";
 import {
   SecretReferenceError,
   collectReferencesDeep
 } from "@opengeni/contracts";
-import { createSecretResolver, hasPermission as hasPermission11 } from "@opengeni/core";
+import { createSecretResolver, hasPermission as hasPermission12 } from "@opengeni/core";
 import {
   createSecretArgumentResolver,
   secretArgumentMode
 } from "@opengeni/runtime/workspace-tool-gateway";
-var siteSecretContexts = new AsyncLocalStorage();
+var siteSecretContexts = new AsyncLocalStorage2();
 function withSiteSecretContext(context, run2) {
   return siteSecretContexts.run(context, run2);
 }
@@ -49107,7 +49129,7 @@ function workspaceGatewaySecretArguments(input) {
     if (secretArgumentMode(call.entry) !== "literal") return call.arguments;
     const site = siteSecretContexts.getStore() ?? null;
     const references = collectReferencesDeep(call.arguments);
-    if (!site && references.length > 0 && !hasPermission11(input.grant.permissions, "secrets:use", input.grant.permissionMode)) {
+    if (!site && references.length > 0 && !hasPermission12(input.grant.permissions, "secrets:use", input.grant.permissionMode)) {
       throw new SecretReferenceError(
         references.map((reference) => ({
           raw: reference.raw,
@@ -49217,7 +49239,7 @@ function workspaceToolGatewayIdentityKey(identity2) {
 }
 
 // src/site-publishing/page-tool-authority.ts
-import { hasPermission as hasPermission12 } from "@opengeni/core";
+import { hasPermission as hasPermission13 } from "@opengeni/core";
 import {
   getPublishedSiteVersion as getPublishedSiteVersion4,
   getWorkspaceGrant as getWorkspaceGrant3,
@@ -49225,12 +49247,12 @@ import {
   withWorkspaceSubjectRls as withWorkspaceSubjectRls3
 } from "@opengeni/db";
 import { HTTPException as HTTPException37 } from "hono/http-exception";
-var authorities = /* @__PURE__ */ new WeakMap();
+var authorities2 = /* @__PURE__ */ new WeakMap();
 function isPublishedSiteToolAuthorization(value) {
-  return authorities.has(value);
+  return authorities2.has(value);
 }
 function publishedSiteToolAuthority(value) {
-  const authority = authorities.get(value);
+  const authority = authorities2.get(value);
   if (!authority) throw new HTTPException37(403, { message: "site_tool_not_authorized" });
   return authority;
 }
@@ -49252,7 +49274,7 @@ async function authorizePublishedSiteTools(deps, domain, fields2) {
         });
       }
     );
-    if (!grant2 || !hasPermission12(grant2.permissions, "workspace:read")) throw denied2();
+    if (!grant2 || !hasPermission13(grant2.permissions, "workspace:read")) throw denied2();
     return { host: host2, viewer, grant: grant2 };
   };
   const initial = await read();
@@ -49261,7 +49283,7 @@ async function authorizePublishedSiteTools(deps, domain, fields2) {
   if (!version2) throw new HTTPException37(403, { message: "site_tool_not_authorized" });
   const reauthorize = async () => {
     const live = await read();
-    if (live.host.site.id !== host.site.id || live.host.versionId !== version2.id || live.grant.accountId !== grant.accountId || live.grant.workspaceId !== grant.workspaceId || live.grant.subjectId !== grant.subjectId || live.viewer.sessionId !== initial.viewer.sessionId || grant.permissions.some((permission) => !hasPermission12(live.grant.permissions, permission)))
+    if (live.host.site.id !== host.site.id || live.host.versionId !== version2.id || live.grant.accountId !== grant.accountId || live.grant.workspaceId !== grant.workspaceId || live.grant.subjectId !== grant.subjectId || live.viewer.sessionId !== initial.viewer.sessionId || grant.permissions.some((permission) => !hasPermission13(live.grant.permissions, permission)))
       throw new HTTPException37(403, { message: "site_tool_access_changed" });
   };
   Object.freeze(grant.permissions);
@@ -49270,7 +49292,7 @@ async function authorizePublishedSiteTools(deps, domain, fields2) {
     kind: "published_site_tools",
     grant
   });
-  authorities.set(authorization, {
+  authorities2.set(authorization, {
     requestedTools: version2.requestedTools,
     origin: { siteId: host.site.id, versionId: version2.id, title: host.site.title },
     reauthorize,
@@ -49372,7 +49394,7 @@ async function prepareWorkspaceToolGateway(routeDeps, authorization, options = {
         );
         const workspace = await requireWorkspace2(tx, scope.workspaceId);
         if (!live || permissions.some(
-          (permission) => !hasPermission13(live.permissions, permission, live.permissionMode)
+          (permission) => !hasPermission14(live.permissions, permission, live.permissionMode)
         ) || workspace.accountId !== scope.accountId || workspace.kind !== "shared")
           throw new HTTPException38(403, { message: "service gateway authority changed" });
       }
@@ -49761,7 +49783,7 @@ async function prepareWorkspaceToolGatewayForGrantInternal(routeDeps, grant, all
   const firstPartyServers = await Promise.all([
     ...gatewayServerIds.has("opengeni") ? [inMemoryMcpRegistration("opengeni", buildOpenGeniMcpServer(deps, grant))] : [],
     ...gatewayServerIds.has("files") ? [inMemoryMcpRegistration("files", buildFilesMcpServer(deps, grant))] : [],
-    ...gatewayServerIds.has("docs") && hasPermission13(grant.permissions, "documents:search") ? [
+    ...gatewayServerIds.has("docs") && hasPermission14(grant.permissions, "documents:search") ? [
       inMemoryMcpRegistration(
         "docs",
         buildDocumentsMcpServer(
@@ -49986,10 +50008,10 @@ function workspaceToolGatewaySettingsForGrant(settings, grant, allowedIdentities
     ...settings,
     mcpServers: settings.mcpServers.filter((server) => {
       if (allowedServerIds && !allowedServerIds.has(server.id)) return false;
-      if (server.id === "docs" && !hasPermission13(grant.permissions, "documents:search")) {
+      if (server.id === "docs" && !hasPermission14(grant.permissions, "documents:search")) {
         return false;
       }
-      if (server.id === "files" && !hasPermission13(grant.permissions, "files:read")) return false;
+      if (server.id === "files" && !hasPermission14(grant.permissions, "files:read")) return false;
       return true;
     })
   };
@@ -51044,10 +51066,10 @@ function renderMcpOAuthExpiredPage(message) {
 async function listConsentWorkspaces(deps, context) {
   const readableWorkspaceIds = [
     ...new Set(
-      context.workspaceGrants.filter((grant) => hasPermission14(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
+      context.workspaceGrants.filter((grant) => hasPermission15(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
     )
   ];
-  const readableAccountIds = context.accountGrants.filter((grant) => hasPermission14(grant.permissions, "workspace:read")).map((grant) => grant.accountId);
+  const readableAccountIds = context.accountGrants.filter((grant) => hasPermission15(grant.permissions, "workspace:read")).map((grant) => grant.accountId);
   const [fromGrants, memberships, shared] = await Promise.all([
     Promise.all(readableWorkspaceIds.map((workspaceId) => getWorkspace2(deps.db, workspaceId))),
     listWorkspacesForSubject(deps.db, context.subjectId),
@@ -51154,7 +51176,7 @@ async function consentOrganizations(deps, context) {
         personal: workspace.kind === "personal"
       })),
       grantable: canonical.filter(
-        (permission) => accountGrant !== void 0 && hasPermission14(accountGrant.permissions, permission) || workspaceGrants.some((grant) => hasPermission14(grant.permissions, permission))
+        (permission) => accountGrant !== void 0 && hasPermission15(accountGrant.permissions, permission) || workspaceGrants.some((grant) => hasPermission15(grant.permissions, permission))
       )
     };
   });
@@ -53019,7 +53041,7 @@ import { HTTPException as HTTPException45 } from "hono/http-exception";
 import {
   accountScopedApiKeyWorkspaceAuthority as accountScopedApiKeyWorkspaceAuthority2,
   organizationApiKeyAccess,
-  hasPermission as hasPermission15,
+  hasPermission as hasPermission16,
   organizationWorkspaceInScope,
   requireAccessContext as requireAccessContext4,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization7,
@@ -53254,7 +53276,7 @@ function ensureOrganizationPolicyDelegable(context, policy, legacy = false) {
   const authority = accountScopedApiKeyWorkspaceAuthority2(context);
   const source = context.credential?.policy;
   if (!authority || authority.permissionMode !== "explicit" || !source) return;
-  const requested = legacy ? Permission2.options.filter((permission) => hasPermission15(policy.permissions, permission)) : policy.permissions;
+  const requested = legacy ? Permission2.options.filter((permission) => hasPermission16(policy.permissions, permission)) : policy.permissions;
   if (requested.some((permission) => !source.permissions.includes(permission)))
     throw new HTTPException45(403, {
       message: "cannot delegate permissions beyond organization key policy"
@@ -53572,7 +53594,7 @@ import { HTTPException as HTTPException48 } from "hono/http-exception";
 // src/workspace-tool-target-fence.ts
 import {
   externalContinuationCommitAuthorizer as externalContinuationCommitAuthorizer2,
-  hasPermission as hasPermission16,
+  hasPermission as hasPermission17,
   isVerifiedOrganizationServiceAuthorization as isVerifiedOrganizationServiceAuthorization3
 } from "@opengeni/core";
 import {
@@ -53627,7 +53649,7 @@ function targetFenceCaller(deps, authorization, reauthorize) {
           grant.workspaceId
         );
         if (!live || permissions.some(
-          (permission) => !hasPermission16(live.permissions, permission, live.permissionMode)
+          (permission) => !hasPermission17(live.permissions, permission, live.permissionMode)
         ))
           throw new HTTPException47(403, { message: "service gateway authority changed" });
       }
@@ -54182,7 +54204,7 @@ import {
   CodemodeCallRequest,
   CodemodeCallSubmission
 } from "@opengeni/contracts";
-import { hasPermission as hasPermission17, isDeveloperSetupGrant, requireSessionAuthorization as requireSessionAuthorization6 } from "@opengeni/core";
+import { hasPermission as hasPermission18, isDeveloperSetupGrant, requireSessionAuthorization as requireSessionAuthorization6 } from "@opengeni/core";
 import {
   CodemodeToolApprovalRequiredError,
   getActiveSessionTurnForExecution,
@@ -54226,7 +54248,7 @@ function codemodeSessionProxyPermissions(settings, session) {
   const selection = allowedFirstPartyMcpToolsForSession2(settings, session.firstPartyMcpTools);
   const requiredBySelection = /* @__PURE__ */ new Set([
     "workspace:read",
-    ...permissionsRequiredByFirstPartyTools(selection)
+    ...permissionsRequiredByFirstPartyTools2(selection)
   ]);
   return CODEMODE_SESSION_PROXY_PERMISSION_CEILING.filter(
     (permission) => requiredBySelection.has(permission) && sessionPermissions.includes(permission)
@@ -54347,7 +54369,7 @@ function codemodeAuthorityForGrant(grant) {
   };
 }
 function isCodemodeGrant(grant) {
-  return hasPermission17(grant.permissions, "codemode:call") && codemodeAuthorityForGrant(grant) !== null;
+  return hasPermission18(grant.permissions, "codemode:call") && codemodeAuthorityForGrant(grant) !== null;
 }
 function requireMatchingCodemodeCatalog(authority, catalog) {
   if (!catalog) throw new CodemodeCatalogNotReadyError();
@@ -54718,7 +54740,7 @@ import {
   siteSessionOriginFromMetadata,
   withSiteSessionOrigin as withSiteSessionOrigin4
 } from "@opengeni/core";
-import { getSession as getSession7 } from "@opengeni/db";
+import { getSession as getSession7, getSessionAuthorityProjection as getSessionAuthorityProjection2 } from "@opengeni/db";
 import { HTTPException as HTTPException50 } from "hono/http-exception";
 var CODEMODE_SDK_PROXY = /^\/v1\/workspaces\/[^/]+\/codemode\/sdk(?:\/|$)/u;
 var SITE_DATA = /^\/v1\/workspaces\/[^/]+\/published-artifacts\/([^/]+)\/(?:data|files)(?:\/|$)/u;
@@ -54750,10 +54772,15 @@ function siteFrameGuard(deps) {
         throw new HTTPException50(404, { message: "Unsupported Site session API path" });
     }
     if (match.sessionId !== null) {
+      const authority = await getSessionAuthorityProjection2(
+        deps.db,
+        grant.workspaceId,
+        match.sessionId
+      );
       const session = await getSession7(deps.db, grant.workspaceId, match.sessionId).catch(
         () => null
       );
-      if (!session || !siteOriginsMatch(origin, siteSessionOriginFromMetadata(session.metadata)))
+      if (!authority?.siteAccessRootId || !session || !siteOriginsMatch(origin, siteSessionOriginFromMetadata(session.metadata)))
         throw new HTTPException50(404, { message: "session not found" });
     }
     if (c.req.method !== "GET" && match.operation.id !== "sessions.create") {
@@ -55587,7 +55614,7 @@ import { sessionUsageLimitsProducerEnabled as sessionUsageLimitsProducerEnabled2
 import {
   CodexCompactionV2ProviderLockedError,
   ManagedAuthActorLeaseOutcomeUnknownError,
-  hasPermission as hasPermission43,
+  hasPermission as hasPermission44,
   requireAccessGrant as requireAccessGrant64,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization42,
   requireFreshAccessGrant as requireFreshAccessGrant5,
@@ -55605,7 +55632,7 @@ import {
   validateManagedAuthRequestActorLease,
   requireSessionAuthorization as requireSessionAuthorization21,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError21,
-  withSessionAuthorizationReadReuse,
+  withSessionAuthorizationReadReuse as withSessionAuthorizationReadReuse3,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError19,
   createUserPresenceRecorder,
   registerProductUsageMetricBaselines,
@@ -57060,9 +57087,9 @@ import {
 import { getOAuthState } from "better-auth/api";
 
 // src/auth/managed-auth-attempt-context.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-var managedAuthAttemptStorage = new AsyncLocalStorage2();
-var managedLinkIntentStorage = new AsyncLocalStorage2();
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var managedAuthAttemptStorage = new AsyncLocalStorage3();
+var managedLinkIntentStorage = new AsyncLocalStorage3();
 function runManagedSignInConnect(intentId, action) {
   return managedLinkIntentStorage.run(intentId, action);
 }
@@ -89503,7 +89530,7 @@ import {
   isPersonalGitHubConnection as isPersonalGitHubConnection2
 } from "@opengeni/contracts/personal-github";
 import {
-  hasPermission as hasPermission18,
+  hasPermission as hasPermission19,
   listOwnConnectionAccountsForGrant,
   hasReservedFikenMetadata,
   ONEPASSWORD_CREDENTIAL_ROLE as ONEPASSWORD_CREDENTIAL_ROLE2,
@@ -91488,7 +91515,7 @@ function registerConnectionRoutes(app, deps) {
       connectionId: c.req.param("connectionId"),
       payload: await c.req.json(),
       canManageOrganizationDestination: authorization.accountGrant?.permissions.includes("account:admin") === true,
-      canManageWorkspaceDestination: hasPermission18(grant.permissions, "workspace:admin"),
+      canManageWorkspaceDestination: hasPermission19(grant.permissions, "workspace:admin"),
       canManagePersonalDestination: authorization.contextIntegrity && authorization.authenticatedSubjectId === grant.subjectId
     });
     return c.json(ConnectionResponse.parse({ connection }));
@@ -91566,7 +91593,7 @@ function registerConnectionRoutes(app, deps) {
         connectionId: c.req.param("connectionId"),
         payload: await c.req.json(),
         canManageOrganizationDestination: authorization.accountGrant?.permissions.includes("account:admin") === true,
-        canManageWorkspaceDestination: hasPermission18(grant.permissions, "workspace:admin"),
+        canManageWorkspaceDestination: hasPermission19(grant.permissions, "workspace:admin"),
         canManagePersonalDestination: authorization.contextIntegrity && authorization.authenticatedSubjectId === grant.subjectId
       });
       return c.json(ConnectionResponse.parse({ connection }));
@@ -91644,7 +91671,7 @@ function registerConnectionRoutes(app, deps) {
             if (destinationSelection.authorityKind === "organization" && authorization.accountGrant?.permissions.includes("account:admin") !== true) {
               throw new HTTPException64(403, { message: "missing permission: account:admin" });
             }
-            if (destinationSelection.authorityKind === "workspace" && !hasPermission18(grant.permissions, "workspace:admin")) {
+            if (destinationSelection.authorityKind === "workspace" && !hasPermission19(grant.permissions, "workspace:admin")) {
               throw new HTTPException64(403, { message: "missing permission: workspace:admin" });
             }
             if (destinationSelection.authorityKind === "personal" && (!authorization.contextIntegrity || authorization.authenticatedSubjectId !== grant.subjectId)) {
@@ -92422,7 +92449,7 @@ import {
 import {
   externalActorContinuationForAuthorization as externalActorContinuationForAuthorization10,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization11,
-  hasPermission as hasPermission20,
+  hasPermission as hasPermission21,
   requireEnvironmentEncryption as requireEnvironmentEncryption15,
   isFikenConnection as isFikenConnection2,
   isOpenGeniSlackBotConnection as isOpenGeniSlackBotConnection4,
@@ -93931,7 +93958,7 @@ import {
 import { withOrganizationIntegrationPolicyFence as withOrganizationIntegrationPolicyFence6 } from "@opengeni/db/organization-integration-policy";
 import {
   externalActorContinuationForAuthorization as externalActorContinuationForAuthorization9,
-  hasPermission as hasPermission19,
+  hasPermission as hasPermission20,
   isDeveloperSetupGrant as isDeveloperSetupGrant2,
   requireSessionAuthorization as requireSessionAuthorization8
 } from "@opengeni/core";
@@ -93957,7 +93984,7 @@ async function connectRequestActor(deps, authorization) {
       preparedOnly: false
     };
   const authority = codemodeAuthorityForGrant(grant);
-  if (!authority || isDeveloperSetupGrant2(grant) || PREPARED_MCP_PERMISSIONS.some((permission) => !hasPermission19(grant.permissions, permission)))
+  if (!authority || isDeveloperSetupGrant2(grant) || PREPARED_MCP_PERMISSIONS.some((permission) => !hasPermission20(grant.permissions, permission)))
     throw new HTTPException68(403, { message: "Prepared MCP setup authority required" });
   await requireSessionAuthorization8(deps, grant, {
     sessionId: authority.sessionId,
@@ -94019,7 +94046,7 @@ function assertAgentPreparedConnect(actor, attempt) {
 
 // src/routes/connect.ts
 function registerConnectRoutes(app, deps) {
-  const canReadAttempt = (permissions, providerId) => ["x", "reddit", "mcp-install"].includes(providerId) ? hasPermission20(permissions, "workspace:read") : providerId === "github-app" ? hasPermission20(permissions, "github:use") || hasPermission20(permissions, "github:manage") : providerId === "github-lens" ? hasPermission20(permissions, "workspace:read") : hasPermission20(permissions, "connections:read");
+  const canReadAttempt = (permissions, providerId) => ["x", "reddit", "mcp-install"].includes(providerId) ? hasPermission21(permissions, "workspace:read") : providerId === "github-app" ? hasPermission21(permissions, "github:use") || hasPermission21(permissions, "github:manage") : providerId === "github-lens" ? hasPermission21(permissions, "workspace:read") : hasPermission21(permissions, "connections:read");
   app.get("/v1/workspaces/:workspaceId/connect/catalog", async (c) => {
     const authorization = await requireAccessGrantAuthorization11(
       c,
@@ -94033,7 +94060,7 @@ function registerConnectRoutes(app, deps) {
       authorization.grant,
       async (_tx, current) => current
     );
-    const canWrite2 = hasPermission20(authorization.grant.permissions, "connections:write");
+    const canWrite2 = hasPermission21(authorization.grant.permissions, "connections:write");
     const personal = isPersonalConnectionOwnerPrincipal(authorization);
     let mcpConfigured = false;
     let credentialConfigured = false;
@@ -94053,7 +94080,7 @@ function registerConnectRoutes(app, deps) {
           configured2 = false;
         }
         const ownership = [
-          ...hasPermission20(authorization.grant.permissions, "workspace:admin") ? ["workspace"] : [],
+          ...hasPermission21(authorization.grant.permissions, "workspace:admin") ? ["workspace"] : [],
           ...personal ? ["personal"] : []
         ];
         return ConnectProvider.parse({
@@ -94069,7 +94096,7 @@ function registerConnectRoutes(app, deps) {
         id: "mcp-install",
         label: "Install MCP capability",
         family: "mcp",
-        readiness: !external || !hasPermission20(authorization.grant.permissions, "capabilities:manage") ? "unsupported" : deps.settings.integrationsEnabled ? "available" : "needs_configuration",
+        readiness: !external || !hasPermission21(authorization.grant.permissions, "capabilities:manage") ? "unsupported" : deps.settings.integrationsEnabled ? "available" : "needs_configuration",
         ownership: ["workspace"],
         setup: ["installation"]
       }),
@@ -94131,7 +94158,7 @@ function registerConnectRoutes(app, deps) {
         id: "github-app",
         label: "GitHub App installation",
         family: "github",
-        readiness: !external || !hasPermission20(authorization.grant.permissions, "github:manage") ? "unsupported" : githubAppMissingSettings3(deps.settings).length === 0 && deps.settings.githubAppSlug?.trim() ? "available" : "needs_configuration",
+        readiness: !external || !hasPermission21(authorization.grant.permissions, "github:manage") ? "unsupported" : githubAppMissingSettings3(deps.settings).length === 0 && deps.settings.githubAppSlug?.trim() ? "available" : "needs_configuration",
         ownership: ["workspace"],
         setup: ["oauth", "installation"]
       }),
@@ -94139,7 +94166,7 @@ function registerConnectRoutes(app, deps) {
         id: "github-lens",
         label: "Opengeni Lens PR review",
         family: "github-lens",
-        readiness: !external || !hasPermission20(authorization.grant.permissions, "workspace:admin") || !hasPermission20(authorization.grant.permissions, "secrets:write") ? "unsupported" : credentialConfigured && deps.settings.sandboxBackend !== "selfhosted" && prReviewGitHubAppMissingSettings2(deps.settings).length === 0 ? "available" : "needs_configuration",
+        readiness: !external || !hasPermission21(authorization.grant.permissions, "workspace:admin") || !hasPermission21(authorization.grant.permissions, "secrets:write") ? "unsupported" : credentialConfigured && deps.settings.sandboxBackend !== "selfhosted" && prReviewGitHubAppMissingSettings2(deps.settings).length === 0 ? "available" : "needs_configuration",
         ownership: ["workspace"],
         setup: ["oauth", "installation"]
       }),
@@ -94205,8 +94232,8 @@ function registerConnectRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId/connect/accounts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const { grant } = await requireAccessGrantAuthorization11(c, deps, workspaceId, "workspace:read");
-    const connections = hasPermission20(grant.permissions, "connections:read") ? await listConnectionsMetadata6(deps.db, workspaceId, grant.subjectId) : [];
-    const githubInstallations = hasPermission20(grant.permissions, "github:use") || hasPermission20(grant.permissions, "github:manage") ? await listGitHubInstallationAccessForWorkspace2(deps.db, workspaceId) : [];
+    const connections = hasPermission21(grant.permissions, "connections:read") ? await listConnectionsMetadata6(deps.db, workspaceId, grant.subjectId) : [];
+    const githubInstallations = hasPermission21(grant.permissions, "github:use") || hasPermission21(grant.permissions, "github:manage") ? await listGitHubInstallationAccessForWorkspace2(deps.db, workspaceId) : [];
     const lensRegistrations = await listPrReviewAppRegistrations(
       deps.db,
       grant.accountId,
@@ -94355,9 +94382,9 @@ function registerConnectRoutes(app, deps) {
     const before = stored.attempt;
     assertAgentPreparedConnect(actor, before);
     const advancePermission = before.providerId === "mcp-install" ? "capabilities:manage" : permission;
-    if (!hasPermission20(authorization.grant.permissions, advancePermission))
+    if (!hasPermission21(authorization.grant.permissions, advancePermission))
       throw new HTTPException69(403, { message: `${advancePermission} required` });
-    if (before.mcpSetup && !hasPermission20(authorization.grant.permissions, "capabilities:manage"))
+    if (before.mcpSetup && !hasPermission21(authorization.grant.permissions, "capabilities:manage"))
       throw new HTTPException69(403, { message: "capabilities:manage required" });
     if (before.providerId === "mcp-install") {
       if (action.type !== "credentials")
@@ -94403,7 +94430,7 @@ function registerConnectRoutes(app, deps) {
     }
     if (["github-app", "github-lens"].includes(before.providerId)) {
       const installationPermission = before.providerId === "github-lens" ? "workspace:admin" : "github:manage";
-      if (!hasPermission20(authorization.grant.permissions, installationPermission) || before.providerId === "github-lens" && !hasPermission20(authorization.grant.permissions, "secrets:write"))
+      if (!hasPermission21(authorization.grant.permissions, installationPermission) || before.providerId === "github-lens" && !hasPermission21(authorization.grant.permissions, "secrets:write"))
         throw new HTTPException69(403, { message: "Installation management permission required" });
       return c.json(
         await executeConnectOperation({
@@ -94894,7 +94921,7 @@ function registerConnectRoutes(app, deps) {
         authorize: async (tx, attempt, origin) => {
           assertAgentPreparedConnect(actor, attempt);
           const permission = attempt.providerId === "mcp-install" ? "capabilities:manage" : ["x", "reddit"].includes(attempt.providerId) ? attempt.ownership === "workspace" ? "workspace:admin" : "workspace:read" : attempt.providerId === "github-app" ? "github:manage" : attempt.providerId === "github-lens" ? "workspace:admin" : "connections:write";
-          if (!hasPermission20(authorization.grant.permissions, permission) || attempt.providerId === "github-lens" && !hasPermission20(authorization.grant.permissions, "secrets:write"))
+          if (!hasPermission21(authorization.grant.permissions, permission) || attempt.providerId === "github-lens" && !hasPermission21(authorization.grant.permissions, "secrets:write"))
             throw new HTTPException69(403, { message: "Connect management permission required" });
           await requireConnectOwnerAuthority(tx, scope, permission, origin);
           if (attempt.providerId === "github-lens")
@@ -94928,7 +94955,7 @@ function registerConnectRoutes(app, deps) {
       throw new HTTPException69(403, {
         message: "Verified Connect authority required"
       });
-    if (input.mcpSetup && !hasPermission20(authorization.grant.permissions, "capabilities:manage"))
+    if (input.mcpSetup && !hasPermission21(authorization.grant.permissions, "capabilities:manage"))
       throw new HTTPException69(403, { message: "capabilities:manage required" });
     if (input.providerId === "atlassian")
       throw new HTTPException69(410, { message: ATLASSIAN_NATIVE_RETIRED_MESSAGE2 });
@@ -95110,7 +95137,7 @@ function registerConnectRoutes(app, deps) {
               message: "GitHub App setup requires workspace ownership and explicit installation selection"
             });
           if (input.providerId === "github-lens") {
-            if (!hasPermission20(authorization.grant.permissions, "secrets:write"))
+            if (!hasPermission21(authorization.grant.permissions, "secrets:write"))
               throw new HTTPException69(403, { message: "secrets:write required" });
             await requireConnectOwnerAuthority(tx, scope, "secrets:write");
             await requireGitHubLensConnect({ ...deps, db: tx });
@@ -95149,7 +95176,7 @@ function registerConnectRoutes(app, deps) {
             throw new HTTPException69(422, { message: "Select the service connection during setup" });
           if (input.ownership === "personal" && !scope.personalOwnerVerified)
             throw new HTTPException69(403, { message: "personal ownership unavailable" });
-          const choices = hasPermission20(authorization.grant.permissions, "connections:read") ? (await listConnectionsMetadata6(tx, workspaceId, scope.subjectId)).filter(
+          const choices = hasPermission21(authorization.grant.permissions, "connections:read") ? (await listConnectionsMetadata6(tx, workspaceId, scope.subjectId)).filter(
             (connection) => connection.status === "active" && (input.ownership === "workspace" ? connection.subjectId === null : connection.subjectId === scope.subjectId)
           ).map((connection) => ({
             value: connection.id,
@@ -95486,7 +95513,7 @@ import {
   requireAccessGrantAuthorization as requireAccessGrantAuthorization12,
   externalActorContinuationForAuthorization as externalActorContinuationForAuthorization11,
   externalContinuationCommitAuthorizer as externalContinuationCommitAuthorizer4,
-  hasPermission as hasPermission21
+  hasPermission as hasPermission22
 } from "@opengeni/core";
 function nativeConfirmation(authorization) {
   if (!authorization.contextIntegrity || !authorization.canonicalManagedHumanSession || authorization.authenticatedSubjectId !== authorization.grant.subjectId || !authorization.grant.subjectId.startsWith("user:"))
@@ -95600,7 +95627,7 @@ function registerExternalIdentityLinkRoutes(app, deps) {
               principalKind: "human_session"
             });
             if (!current || current.accountId !== grant.accountId || request.permissions.some(
-              (permission) => !hasPermission21(grant.permissions, permission) || !hasPermission21(current.permissions, permission)
+              (permission) => !hasPermission22(grant.permissions, permission) || !hasPermission22(current.permissions, permission)
             ))
               throw new HTTPException70(403, {
                 message: "Link permissions exceed your authority in this workspace"
@@ -96475,7 +96502,7 @@ import {
   KnowledgeVectorCreditsDisabledError,
   KnowledgeVectorFundingError,
   KnowledgeVectorQueryRejectedError,
-  hasPermission as hasPermission22,
+  hasPermission as hasPermission23,
   knowledgeContextForAccess as knowledgeContextForAccess2,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization14,
   requireSessionAuthorization as requireSessionAuthorization9,
@@ -96571,7 +96598,7 @@ function registerKnowledgeRoutes(app, deps) {
         c.req.param("workspaceId"),
         write ? "documents:manage" : readPermission === "workspace:read" ? void 0 : readPermission
       );
-      const permission = write ? "documents:manage" : readPermission === "workspace:read" && hasPermission22(access.grant.permissions, "documents:search") ? "documents:search" : readPermission;
+      const permission = write ? "documents:manage" : readPermission === "workspace:read" && hasPermission23(access.grant.permissions, "documents:search") ? "documents:search" : readPermission;
       return await withAccessGrantSessionRlsContext(deps, access.grant, async () => {
         const context = await knowledgeContextForAccess2(deps, access, permission);
         c.header("cache-control", "private, no-store");
@@ -96901,7 +96928,7 @@ function registerKnowledgeRoutes(app, deps) {
         throw new HTTPException72(403, { message: "Agents cannot change learning settings" });
       const access = await requireAccessGrantAuthorization14(c, deps, context.workspaceId);
       if (request.source?.kind === "chat") {
-        if (!hasPermission22(access.grant.permissions, "sessions:control"))
+        if (!hasPermission23(access.grant.permissions, "sessions:control"))
           throw new HTTPException72(403, { message: "Chat settings require session control" });
         await requireSessionAuthorization9(deps, access.grant, {
           sessionId: request.source.id,
@@ -96910,7 +96937,7 @@ function registerKnowledgeRoutes(app, deps) {
         });
         context.actor.settingsScopes = [request.scope];
       } else if (request.source?.kind === "scheduled_task") {
-        if (!hasPermission22(access.grant.permissions, "scheduled_tasks:manage"))
+        if (!hasPermission23(access.grant.permissions, "scheduled_tasks:manage"))
           throw new HTTPException72(403, {
             message: "Scheduled task settings require task management"
           });
@@ -99032,7 +99059,7 @@ import {
   revokeOrganizationMcpConnection,
   updateOrganizationMcpConnectionAccess
 } from "@opengeni/db";
-import { hasPermission as hasPermission23, requireAccessContext as requireAccessContext8 } from "@opengeni/core";
+import { hasPermission as hasPermission24, requireAccessContext as requireAccessContext8 } from "@opengeni/core";
 import { HTTPException as HTTPException77 } from "hono/http-exception";
 import { z as z49 } from "zod";
 function registerOrganizationMcpConnectionRoutes(app, deps) {
@@ -99117,7 +99144,7 @@ async function requireOrganizationPerson2(c, deps) {
   if (context.mode !== "managed" || !context.subjectId.startsWith("user:") || !grant) {
     throw new HTTPException77(404, { message: "organization not found" });
   }
-  return { context, organizationId: organizationId2, admin: hasPermission23(grant.permissions, "account:admin") };
+  return { context, organizationId: organizationId2, admin: hasPermission24(grant.permissions, "account:admin") };
 }
 async function requireConnection(deps, organizationId2, connectionId) {
   if (!z49.string().uuid().safeParse(connectionId).success) {
@@ -99185,7 +99212,7 @@ import {
   revokePersonalApiKey
 } from "@opengeni/db";
 import {
-  hasPermission as hasPermission24,
+  hasPermission as hasPermission25,
   PERSONAL_API_KEY_TOKEN_PREFIX,
   requireAccessContext as requireAccessContext9
 } from "@opengeni/core";
@@ -99275,7 +99302,7 @@ async function requireOrganizationPerson3(c, deps, mutation) {
   if (context.mode !== "managed" || !context.subjectId.startsWith("user:") || !grant) {
     throw new HTTPException78(404, { message: "organization not found" });
   }
-  return { context, organizationId: organizationId2, admin: hasPermission24(grant.permissions, "account:admin") };
+  return { context, organizationId: organizationId2, admin: hasPermission25(grant.permissions, "account:admin") };
 }
 async function projectKeys(deps, keys2) {
   const userIds = [...new Set(keys2.map((key2) => key2.ownerSubjectId.slice("user:".length)))];
@@ -100633,6 +100660,7 @@ import {
 import {
   requireAccessGrant as requireAccessGrant31,
   requireSessionAuthorization as requireSessionAuthorization13,
+  withSessionAuthorizationReadReuse,
   recordWorkspaceUsage as recordWorkspaceUsage5,
   requireLimit as requireLimit6,
   relayConfigFromSettings as relayConfigFromSettings3,
@@ -102643,7 +102671,7 @@ function registerBrowserSessionRoutes(app, deps, options = {}) {
                 fileIds: workspaceFileIds
               });
               const ordered = requireAuthorizedBrowserUploadFiles(workspaceFileIds, files);
-              const authorities2 = await Promise.all(
+              const authorities3 = await Promise.all(
                 ordered.map(async (file) => {
                   const signed = await deps.objectStorage.createGetUrl({
                     key: file.objectKey,
@@ -102664,7 +102692,7 @@ function registerBrowserSessionRoutes(app, deps, options = {}) {
               );
               await sessionClient.stageWorkspaceFiles({
                 operationId: request.operationId,
-                files: authorities2
+                files: authorities3
               });
             }
           }
@@ -104137,6 +104165,7 @@ function registerBrowserSessionRoutes(app, deps, options = {}) {
         operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
         transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+        browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
         ...deps.settings.agentOpStreamEnabled === true && enrollment.opStream === true && deps.bus.getOpStreamConnection ? {
           opStream: {
             transport: new NatsOpStreamTransport2(
@@ -104380,6 +104409,22 @@ function registerBrowserSessionRoutes(app, deps, options = {}) {
     });
   }
   async function withActiveBrowserController(context, grant, workspaceId, browserSessionId, authorizationOperation, channelOperation, callback, recoverMissing = true, stages) {
+    return await withSessionAuthorizationReadReuse(
+      (authorizationReads) => withActiveBrowserControllerReads(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        authorizationOperation,
+        channelOperation,
+        callback,
+        recoverMissing,
+        stages,
+        authorizationReads
+      )
+    );
+  }
+  async function withActiveBrowserControllerReads(context, grant, workspaceId, browserSessionId, authorizationOperation, channelOperation, callback, recoverMissing, stages, authorizationReads) {
     try {
       const record8 = await getBrowserSessionControlRecord(deps.db, {
         accountId: grant.accountId,
@@ -104387,17 +104432,18 @@ function registerBrowserSessionRoutes(app, deps, options = {}) {
         browserSessionId
       });
       stages?.mark("record");
-      const sourceAuthorization = await authorizeSourceSession2(
-        deps,
-        grant,
-        record8.sourceSessionId,
-        authorizationOperation
-      );
+      const sourceSessionNeeded = record8.session.placement?.kind === "connected_machine" || !record8.controllerHostSandboxGroupId;
+      const [authorized, sourceRead] = await Promise.allSettled([
+        authorizeSourceSession2(deps, grant, record8.sourceSessionId, authorizationOperation),
+        sourceSessionNeeded ? requireSourceSession(deps, workspaceId, record8.sourceSessionId) : Promise.resolve(null)
+      ]);
+      if (authorized.status === "rejected") throw authorized.reason;
+      if (sourceRead.status === "rejected") throw sourceRead.reason;
+      const sourceAuthorization = authorized.value;
       stages?.mark("authorize");
-      let sourceSession = null;
+      let sourceSession = sourceRead.value;
       if (record8.session.placement?.kind === "connected_machine") {
-        sourceSession = await requireSourceSession(deps, workspaceId, record8.sourceSessionId);
-        if (sourceSession.activeSandboxId !== record8.session.placement.sandboxId) {
+        if (sourceSession?.activeSandboxId !== record8.session.placement.sandboxId) {
           return await throwBrowserSourcePlacementChanged(
             grant,
             record8.sourceSessionId,
@@ -104424,6 +104470,7 @@ function registerBrowserSessionRoutes(app, deps, options = {}) {
       let controllerTransportFailed = false;
       const controllerRecoveryState = { attempted: false };
       const run2 = async (placement, provisionedClient) => {
+        authorizationReads.handOffToToolDispatch();
         const client = provisionedClient ?? connectController(deps, grant, record8, placement);
         const tokens = (0, browser_controller_authority_exports.deriveBrowserSessionControllerTokens)({
           rootSecret: browserAuthorityRoot(deps),
@@ -106098,9 +106145,10 @@ import {
   touchComputerSessionController
 } from "@opengeni/db";
 import {
-  hasPermission as hasPermission25,
+  hasPermission as hasPermission26,
   requireAccessGrant as requireAccessGrant32,
   requireSessionAuthorization as requireSessionAuthorization14,
+  withSessionAuthorizationReadReuse as withSessionAuthorizationReadReuse2,
   relayConfigFromSettings as relayConfigFromSettings4,
   resolveChannelAMachineConnection as resolveChannelAMachineConnection2,
   resolveSessionSandboxRuntime as resolveSessionSandboxRuntime4,
@@ -106823,7 +106871,7 @@ function registerComputerSessionRoutes(app, deps, options = {}) {
     }
   );
   async function authorizeHumanFrameInput(grant, record8, placement) {
-    if ((record8.session.placement.kind === "connected_machine" || record8.session.placement.kind === "attached_device") && placement.screenControlAllowed !== true || record8.session.placement.kind === "sandbox_group" && deps.settings.sandboxDesktopInteractive === false || grant.principalKind === "agent_attempt" || !hasPermission25(grant.permissions, "sessions:control"))
+    if ((record8.session.placement.kind === "connected_machine" || record8.session.placement.kind === "attached_device") && placement.screenControlAllowed !== true || record8.session.placement.kind === "sandbox_group" && deps.settings.sandboxDesktopInteractive === false || grant.principalKind === "agent_attempt" || !hasPermission26(grant.permissions, "sessions:control"))
       return false;
     try {
       await requireSessionAuthorization14(deps, grant, {
@@ -106994,6 +107042,32 @@ function registerComputerSessionRoutes(app, deps, options = {}) {
       }
     }
   );
+  async function routedMachineConnection(handle, grant, sourceSession, sandboxId) {
+    const machineAuthority = await handle.machineAuthority();
+    const sandbox = await getSandbox5(
+      deps.db,
+      {
+        accountId: grant.accountId,
+        workspaceId: sourceSession.workspaceId,
+        subjectId: machineAuthority.subjectId
+      },
+      sandboxId
+    );
+    if (sandbox?.kind !== "selfhosted" || !sandbox.enrollmentId) {
+      throw new ComputerSessionStateError("Connected Machine placement is unavailable");
+    }
+    return await resolveChannelAMachineConnection2(
+      deps.db,
+      {
+        accountId: grant.accountId,
+        workspaceId: sourceSession.workspaceId,
+        sessionId: sourceSession.id,
+        machineWorkspaceId: sandbox.workspaceId,
+        enrollmentId: sandbox.enrollmentId
+      },
+      machineAuthority
+    );
+  }
   async function withComputerPlacement(sourceSession, grant, expectedPlacement, expectedPlacementInstanceId, operation, waitSignal, callback) {
     if (expectedPlacement?.kind === "external_provider") {
       throw new BrowserControlUnsupportedError3(
@@ -107041,6 +107115,7 @@ function registerComputerSessionRoutes(app, deps, options = {}) {
         operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
         transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+        browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
         ...deps.settings.agentOpStreamEnabled === true && enrollment.opStream === true && deps.bus.getOpStreamConnection ? {
           opStream: {
             transport: new NatsOpStreamTransport3(
@@ -107088,30 +107163,7 @@ function registerComputerSessionRoutes(app, deps, options = {}) {
         const resolved = await handle.routingSession.prime();
         let screenControlAllowed = false;
         if (operation !== "computer.end" && resolved.kind === "selfhosted" && resolved.sandboxId) {
-          const machineAuthority = await handle.machineAuthority();
-          const sandbox = await getSandbox5(
-            deps.db,
-            {
-              accountId: grant.accountId,
-              workspaceId: sourceSession.workspaceId,
-              subjectId: machineAuthority.subjectId
-            },
-            resolved.sandboxId
-          );
-          if (sandbox?.kind !== "selfhosted" || !sandbox.enrollmentId) {
-            throw new ComputerSessionStateError("Connected Machine placement is unavailable");
-          }
-          const enrollment = await resolveChannelAMachineConnection2(
-            deps.db,
-            {
-              accountId: grant.accountId,
-              workspaceId: sourceSession.workspaceId,
-              sessionId: sourceSession.id,
-              machineWorkspaceId: sandbox.workspaceId,
-              enrollmentId: sandbox.enrollmentId
-            },
-            machineAuthority
-          );
+          const enrollment = handle.pinnedMachine?.sandboxId === resolved.sandboxId ? handle.pinnedMachine.enrollment : await routedMachineConnection(handle, grant, sourceSession, resolved.sandboxId);
           if (!enrollment?.connectionInstanceId) {
             throw new ComputerSessionStateError("Connected Machine is unavailable");
           }
@@ -107273,17 +107325,37 @@ function registerComputerSessionRoutes(app, deps, options = {}) {
     });
   }
   async function withActiveComputerController(context, grant, workspaceId, computerSessionId, authorizationOperation, channelOperation, callback, recoverMissing = true) {
+    return await withSessionAuthorizationReadReuse2(
+      (authorizationReads) => withActiveComputerControllerReads(
+        context,
+        grant,
+        workspaceId,
+        computerSessionId,
+        authorizationOperation,
+        channelOperation,
+        callback,
+        recoverMissing,
+        authorizationReads
+      )
+    );
+  }
+  async function withActiveComputerControllerReads(context, grant, workspaceId, computerSessionId, authorizationOperation, channelOperation, callback, recoverMissing, authorizationReads) {
     try {
       const record8 = await getComputerSessionControlRecord2(deps.db, {
         accountId: grant.accountId,
         workspaceId,
         computerSessionId
       });
-      await authorizeSourceSession3(deps, grant, record8.sourceSessionId, authorizationOperation);
-      let sourceSession = null;
+      const sourceSessionNeeded = record8.session.placement?.kind !== "sandbox_group";
+      const [authorized, sourceRead] = await Promise.allSettled([
+        authorizeSourceSession3(deps, grant, record8.sourceSessionId, authorizationOperation),
+        sourceSessionNeeded ? requireSourceSession2(deps, workspaceId, record8.sourceSessionId) : Promise.resolve(null)
+      ]);
+      if (authorized.status === "rejected") throw authorized.reason;
+      if (sourceRead.status === "rejected") throw sourceRead.reason;
+      let sourceSession = sourceRead.value;
       if (record8.session.placement?.kind === "connected_machine") {
-        sourceSession = await requireSourceSession2(deps, workspaceId, record8.sourceSessionId);
-        if (sourceSession.activeSandboxId !== record8.session.placement.sandboxId) {
+        if (sourceSession?.activeSandboxId !== record8.session.placement.sandboxId) {
           return await throwComputerSourcePlacementChanged(
             grant,
             record8.sourceSessionId,
@@ -107305,6 +107377,7 @@ function registerComputerSessionRoutes(app, deps, options = {}) {
         throw new ComputerSessionStateError("ComputerSession controller authority changed");
       }
       const run2 = async (placement) => {
+        authorizationReads.handOffToToolDispatch();
         const client = connectController2(grant, record8, placement);
         const tokens = (0, browser_controller_authority_exports.deriveComputerSessionControllerTokens)({
           rootSecret: controllerAuthorityRoot(deps),
@@ -107994,7 +108067,7 @@ import { deleteCookie, setCookie } from "hono/cookie";
 import { HTTPException as HTTPException87 } from "hono/http-exception";
 import {
   githubAppActionPolicyActor,
-  hasPermission as hasPermission27,
+  hasPermission as hasPermission28,
   listGitHubActionPolicyActors,
   personalGitHubActionPolicyActor,
   requireAccessGrant as requireAccessGrant33,
@@ -108010,7 +108083,7 @@ import { HTTPException as HTTPException86 } from "hono/http-exception";
 import {
   externalActorContinuationForAuthorization as externalActorContinuationForAuthorization12,
   requireConnectOwnerAuthority as requireConnectOwnerAuthority3,
-  hasPermission as hasPermission26
+  hasPermission as hasPermission27
 } from "@opengeni/core";
 async function integrationCommitGrant(authorization, permissions, request) {
   const grant = structuredClone(authorization.grant);
@@ -108027,7 +108100,7 @@ async function integrationCommitGrant(authorization, permissions, request) {
   const secret = resolveFirstPartyDelegationSecret6(request.settings);
   const signed = token && secret ? await verifyDelegatedAccessToken2(secret, token) : null;
   if (signed) {
-    const matches = (value) => value.accountId === state.accountId && value.workspaceId === state.workspaceId && value.subjectId === state.subjectId && required.every((permission) => hasPermission26(value.permissions, permission));
+    const matches = (value) => value.accountId === state.accountId && value.workspaceId === state.workspaceId && value.subjectId === state.subjectId && required.every((permission) => hasPermission27(value.permissions, permission));
     if (!matches(signed))
       throw new HTTPException86(403, { message: "Integration bearer authority mismatch" });
     return {
@@ -108105,7 +108178,7 @@ function registerGitHubRoutes(app, deps) {
     const installations = missing.length === 0 ? await listWorkspaceGitHubInstallationBindings(deps, grant.workspaceId) : [];
     const status = githubBindingStatus(missing.length === 0, installations);
     const setupMode = settings.productAccessMode === "managed" ? "platform" : "operator";
-    const canManage = !externalActorContinuationForAuthorization13(access) && hasPermission27(grant.permissions, "github:manage");
+    const canManage = !externalActorContinuationForAuthorization13(access) && hasPermission28(grant.permissions, "github:manage");
     const returnPath = githubSessionReturnPath(c.req.query("returnPath"), grant.workspaceId);
     const connectState = missing.length === 0 && slug && canManage ? createSignedState13(githubStateSecret, {
       accountId: grant.accountId,
@@ -108899,7 +108972,7 @@ function githubRepositoryBranchesRouteError(error) {
   return new HTTPException87(502, { message: "GitHub branch discovery is unavailable" });
 }
 function requirePublicGitHubRepositoryVerificationPermission(grant) {
-  if (hasPermission27(grant.permissions, "sessions:create") || hasPermission27(grant.permissions, "sessions:control")) {
+  if (hasPermission28(grant.permissions, "sessions:create") || hasPermission28(grant.permissions, "sessions:control")) {
     return;
   }
   throw new HTTPException87(403, {
@@ -109774,7 +109847,7 @@ import {
   buildConnectionTokenResolver as buildConnectionTokenResolver8,
   getConnectionMetadata as getConnectionMetadata13,
   getPersonalGitHubRepositorySelectionState as getPersonalGitHubRepositorySelectionState3,
-  getSessionAuthorityProjection as getSessionAuthorityProjection2,
+  getSessionAuthorityProjection as getSessionAuthorityProjection3,
   getSessionTurnForAttempt,
   resolveAcceptedConnectionUse
 } from "@opengeni/db";
@@ -109957,7 +110030,7 @@ async function resolveBrokerAuthority(deps, secret, claims, routeId) {
     claims.sessionId,
     claims.attemptId
   );
-  const session = await getSessionAuthorityProjection2(
+  const session = await getSessionAuthorityProjection3(
     deps.db,
     claims.workspaceId,
     claims.sessionId
@@ -110297,7 +110370,7 @@ import {
 import { withOrganizationIntegrationPolicyFence as withOrganizationIntegrationPolicyFence8 } from "@opengeni/db/organization-integration-policy";
 import { CORE_INTEGRATION_DEFINITIONS as CORE_INTEGRATION_DEFINITIONS5 } from "@opengeni/capabilities";
 import {
-  hasPermission as hasPermission28,
+  hasPermission as hasPermission29,
   requireAccessGrant as requireAccessGrant35,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization20
 } from "@opengeni/core";
@@ -110363,7 +110436,7 @@ function registerIntegrationFacetRoutes(app, deps) {
               facetKey: decoded(c.req.param("facetKey")),
               payload: await c.req.json(),
               canManageOrganizationDestination: authorization.accountGrant?.permissions.includes("account:admin") === true,
-              canManageWorkspaceDestination: hasPermission28(
+              canManageWorkspaceDestination: hasPermission29(
                 grant.permissions,
                 "capabilities:manage"
               ),
@@ -110634,6 +110707,7 @@ import {
   getWorkspaceInteractionRevisionState,
   listSessionEventPage as listSessionEventPage2,
   listWorkspaceControlEvents,
+  getWorkspaceControlEvent,
   readSessionEventStorageGapEnd
 } from "@opengeni/db";
 import {
@@ -111163,7 +111237,8 @@ async function sseWorkspaceControlStream(db, bus, workspaceId, after, signal, op
         }
       }
     }
-    await writeFrame(formatWorkspaceControlEventSse(event));
+    const visible = await getWorkspaceControlEvent(db, workspaceId, event.id);
+    if (visible) await writeFrame(formatWorkspaceControlEventSse(visible));
     lastSent = event.sequence;
   };
   delivery = createLatestWinsDelivery(send, fail);
@@ -112384,7 +112459,7 @@ import {
 } from "@opengeni/contracts";
 import {
   automationRequestDigest as automationRequestDigest2,
-  hasPermission as hasPermission29,
+  hasPermission as hasPermission30,
   requireAutomationAdapter as requireAutomationAdapter2,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization21,
   externalActorContinuationForAuthorization as externalActorContinuationForAuthorization14,
@@ -113189,7 +113264,7 @@ function registerPrReviewGitHubRoutes(app, deps) {
       grant.accountId,
       workspaceId
     );
-    const canManage = !externalActorContinuationForAuthorization14(access) && hasPermission29(grant.permissions, "workspace:admin") && hasPermission29(grant.permissions, "secrets:write");
+    const canManage = !externalActorContinuationForAuthorization14(access) && hasPermission30(grant.permissions, "workspace:admin") && hasPermission30(grant.permissions, "secrets:write");
     const connectState = configured2 && canManage ? createSignedState14(deps.githubStateSecret, {
       accountId: grant.accountId,
       workspaceId,
@@ -113555,7 +113630,7 @@ async function requirePrReviewManageGrant(c, deps, workspaceId, state) {
   return grant;
 }
 function prReviewBrowserGrantClaims(deps, grant) {
-  if (deps.settings.productAccessMode !== "configured" || !hasPermission29(grant.permissions, "workspace:admin") || !hasPermission29(grant.permissions, "secrets:write")) {
+  if (deps.settings.productAccessMode !== "configured" || !hasPermission30(grant.permissions, "workspace:admin") || !hasPermission30(grant.permissions, "secrets:write")) {
     return {};
   }
   return {
@@ -115196,7 +115271,7 @@ import {
   SupersedePreferenceRegistryRequest as SupersedePreferenceRegistryRequest2
 } from "@opengeni/contracts";
 import {
-  hasPermission as hasPermission30,
+  hasPermission as hasPermission31,
   requireAccessGrant as requireAccessGrant40,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization24
 } from "@opengeni/core";
@@ -115276,7 +115351,7 @@ function authorizePreferenceRegistryScopeMutation(access, scope) {
     }
     return;
   }
-  if (scope === "workspace" && !hasPermission30(grant.permissions, "workspace:admin")) {
+  if (scope === "workspace" && !hasPermission31(grant.permissions, "workspace:admin")) {
     throw new HTTPException98(403, { message: "missing permission: workspace:admin" });
   }
 }
@@ -116543,7 +116618,7 @@ function registerScheduledTaskRoutes(app, deps) {
       settings: catalogSettings,
       authorization,
       tasks,
-      permissionsRequiredByTools: permissionsRequiredByFirstPartyTools,
+      permissionsRequiredByTools: permissionsRequiredByFirstPartyTools2,
       onError: (error) => {
         deps.observability?.warn("Scheduled task access drift could not be computed", {
           errorClass: error instanceof Error ? error.name : "ScheduledTaskPolicyDriftError",
@@ -116729,7 +116804,7 @@ function registerScheduledTaskRoutes(app, deps) {
       authorization,
       taskId: c.req.param("taskId"),
       request: parsed.data,
-      permissionsRequiredByTools: permissionsRequiredByFirstPartyTools,
+      permissionsRequiredByTools: permissionsRequiredByFirstPartyTools2,
       sessionAuthorization: deps.sessionAuthorization,
       authorizationSurface: "http"
     });
@@ -117496,7 +117571,12 @@ import {
   SITE_FRAME_SESSION_CREATE_FIELDS,
   siteFrameBodyRefusal as siteFrameBodyRefusal2
 } from "@opengeni/contracts/site-session-http";
-import { requireWorkspace as requireWorkspace5, scheduledSessionIds } from "@opengeni/db";
+import {
+  requireWorkspace as requireWorkspace5,
+  scheduledSessionIds,
+  currentSiteViewerRlsContext,
+  nestedPostgresSqlState as nestedPostgresSqlState12
+} from "@opengeni/db";
 import {
   currentSiteSessionOrigin as currentSiteSessionOrigin4,
   isVerifiedDelegatedHumanAuthorization as isVerifiedDelegatedHumanAuthorization4,
@@ -117988,7 +118068,7 @@ import {
 import { HTTPException as HTTPException105 } from "hono/http-exception";
 import {
   getManagedAuthRequestActorEpoch as getManagedAuthRequestActorEpoch2,
-  hasPermission as hasPermission31,
+  hasPermission as hasPermission32,
   requireAccessGrant as requireAccessGrant46,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization29,
   requireFreshAccessGrant as requireFreshAccessGrant3,
@@ -118330,7 +118410,7 @@ function childRequiresActionRespondedByKindForGrant(grant) {
   return "human";
 }
 function requireViewerLifecyclePermission(grant) {
-  if (VIEWER_LIFECYCLE_PERMISSIONS.some((permission) => hasPermission31(grant.permissions, permission))) {
+  if (VIEWER_LIFECYCLE_PERMISSIONS.some((permission) => hasPermission32(grant.permissions, permission))) {
     return;
   }
   throw new HTTPException105(403, {
@@ -118596,7 +118676,7 @@ function registerSessionRoutes(app, deps) {
         )
       );
       const siteOrigin = origin ?? currentSiteSessionOrigin4();
-      if (siteOrigin && grant.subjectId !== `site:${siteOrigin.siteId}`) {
+      if (siteOrigin && currentSiteViewerRlsContext()?.siteId !== siteOrigin.siteId) {
         const refused4 = siteFrameBodyRefusal2("sessions.create", "/sessions", payload);
         if (refused4)
           return c.json(
@@ -118612,6 +118692,8 @@ function registerSessionRoutes(app, deps) {
           siteId: siteOrigin.siteId,
           versionId: siteOrigin.versionId ?? null
         });
+        if (grant.principalKind !== "agent_attempt")
+          payload.visibility = "private";
       }
       const create = () => createSessionForRequest(deps, grant, workspaceId, payload, authorization);
       session = await measureSessionCreatePhase(
@@ -118849,7 +118931,7 @@ function registerSessionRoutes(app, deps) {
       workspaceId,
       sessionIds: [...page2.pinned, ...page2.sessions].map((session) => session.id)
     });
-    const scheduleTargets = hasPermission31(grant.permissions, "scheduled_tasks:run") && hasPermission31(grant.permissions, "sessions:control") ? await scheduledSessionIds(
+    const scheduleTargets = hasPermission32(grant.permissions, "scheduled_tasks:run") && hasPermission32(grant.permissions, "sessions:control") ? await scheduledSessionIds(
       db,
       workspaceId,
       [...page2.pinned, ...page2.sessions].map((session) => session.id)
@@ -119085,7 +119167,7 @@ function registerSessionRoutes(app, deps) {
         workspaceId,
         sessionIds: [sessionId]
       }),
-      hasPermission31(grant.permissions, "scheduled_tasks:run") && hasPermission31(grant.permissions, "sessions:control") ? scheduledSessionIds(db, workspaceId, [sessionId]) : Promise.resolve(/* @__PURE__ */ new Set()),
+      hasPermission32(grant.permissions, "scheduled_tasks:run") && hasPermission32(grant.permissions, "sessions:control") ? scheduledSessionIds(db, workspaceId, [sessionId]) : Promise.resolve(/* @__PURE__ */ new Set()),
       loadEffectivePolicyContext(deps, workspaceId, grant.subjectId, [session])
     ]);
     const usageLimit = await sessionUsageLimitForRead(db, session, {
@@ -120156,7 +120238,7 @@ function registerSessionRoutes(app, deps) {
       }
     };
     collect(lineage.children);
-    const targets = hasPermission31(grant.permissions, "scheduled_tasks:run") && hasPermission31(grant.permissions, "sessions:control") ? await scheduledSessionIds(db, workspaceId, sessionIds) : /* @__PURE__ */ new Set();
+    const targets = hasPermission32(grant.permissions, "scheduled_tasks:run") && hasPermission32(grant.permissions, "sessions:control") ? await scheduledSessionIds(db, workspaceId, sessionIds) : /* @__PURE__ */ new Set();
     const decorateNodes = (nodes) => nodes.map((node) => ({
       ...node,
       session: { ...node.session, hasSchedules: targets.has(node.session.id) },
@@ -121159,6 +121241,7 @@ function registerSessionRoutes(app, deps) {
         actorEpoch: getManagedAuthRequestActorEpoch2(c.req.raw) ?? void 0,
         reauthorizeAfterMs: authorization?.reauthorizeAfterMs ?? SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
         reauthorize: async () => {
+          await reauthorizeSiteSessionRequest(c.req.raw);
           const freshGrant = await requireFreshAccessGrant3(c, deps, workspaceId, "sessions:read");
           await requireSessionAuthorization16(deps, freshGrant, {
             sessionId,
@@ -122879,7 +122962,7 @@ function sessionTenancyHttpError(error) {
       retryable: false
     });
   }
-  if (error instanceof SessionTenancyNotActivatedError2) {
+  if (error instanceof SessionTenancyNotActivatedError2 || nestedPostgresSqlState12(error) === "P0793") {
     return new ApiHttpError(409, {
       code: "conflict",
       message: "Only-me chats are not enabled for this organization.",
@@ -123505,7 +123588,7 @@ function sessionCreateErrorResponse(c, error) {
       403
     );
   }
-  if (error instanceof SessionTenancyNotActivatedError2) {
+  if (error instanceof SessionTenancyNotActivatedError2 || nestedPostgresSqlState12(error) === "P0793") {
     return c.json(
       {
         code: "SESSION_TENANCY_NOT_ACTIVATED",
@@ -123622,7 +123705,7 @@ var ARCHIVE_LIVE_WORK_STATUSES = /* @__PURE__ */ new Set([
 async function pauseOwnArchivedWork(deps, grant, workspaceId, session) {
   if (session.createdBy.kind !== "subject" || session.createdBy.subjectId !== grant.subjectId)
     return session;
-  if (!hasPermission31(grant.permissions, "sessions:control")) return session;
+  if (!hasPermission32(grant.permissions, "sessions:control")) return session;
   if (session.effectiveControl.directState === "paused") return session;
   const liveWork = ARCHIVE_LIVE_WORK_STATUSES.has(session.status) || session.activeTurnId !== null || Boolean(session.inputWait) || (await getSessionGoal2(deps.db, workspaceId, session.id))?.status === "active";
   if (!liveWork) return session;
@@ -123982,7 +124065,7 @@ import {
   replayWorkspaceGatewayCustomModelCreate,
   replayWorkspaceOpenRouterCustomModelCreate,
   listWorkspacesForSubject as listWorkspacesForSubject3,
-  nestedPostgresSqlState as nestedPostgresSqlState13,
+  nestedPostgresSqlState as nestedPostgresSqlState14,
   removeWorkspaceMember,
   requireWorkspace as requireWorkspace6,
   updateWorkspaceSettings,
@@ -124014,7 +124097,7 @@ import {
   getManagedAuthRequestActorEpoch as getManagedAuthRequestActorEpoch3,
   accountScopedApiKeyWorkspaceAuthority as accountScopedApiKeyWorkspaceAuthority5,
   organizationWorkspaceInScope as organizationWorkspaceInScope2,
-  hasPermission as hasPermission32,
+  hasPermission as hasPermission33,
   requireAccessContext as requireAccessContext12,
   requireApiKeyDelegationContext,
   requireExplicitPermissionDelegation as requireExplicitPermissionDelegation2,
@@ -124045,7 +124128,7 @@ import {
 // src/workspace-deletion.ts
 import {
   deleteWorkspaceIfQuiescent,
-  nestedPostgresSqlState as nestedPostgresSqlState12,
+  nestedPostgresSqlState as nestedPostgresSqlState13,
   safeDatabaseErrorFacts
 } from "@opengeni/db";
 import { HTTPException as HTTPException107 } from "hono/http-exception";
@@ -124138,7 +124221,7 @@ async function deleteWorkspaceForRequest(deps, input) {
       ...observer ? { observer } : {}
     });
   } catch (error) {
-    const state = nestedPostgresSqlState12(error);
+    const state = nestedPostgresSqlState13(error);
     if (state === "42501") {
       throw new HTTPException107(403, { message: "organization administration is not authorized" });
     }
@@ -124295,7 +124378,7 @@ function registerWorkspaceRoutes(app, deps) {
       return c.json(externalWorkspaces.map((workspace) => Workspace.parse(workspace)));
     const accountScopedAuthority = accountScopedApiKeyWorkspaceAuthority5(context);
     if (accountScopedAuthority) {
-      if (!hasPermission32(accountScopedAuthority.permissions, "workspace:read")) return c.json([]);
+      if (!hasPermission33(accountScopedAuthority.permissions, "workspace:read")) return c.json([]);
       return c.json(
         (await listSharedWorkspacesForAccount2(deps.db, accountScopedAuthority.accountId)).filter(
           (workspace) => organizationWorkspaceInScope2(accountScopedAuthority.workspaceScope, workspace.id)
@@ -124304,7 +124387,7 @@ function registerWorkspaceRoutes(app, deps) {
     }
     const readableWorkspaceIds = [
       ...new Set(
-        context.workspaceGrants.filter((grant) => hasPermission32(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
+        context.workspaceGrants.filter((grant) => hasPermission33(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
       )
     ];
     if (readableWorkspaceIds.length > 0) {
@@ -124495,7 +124578,7 @@ function registerWorkspaceRoutes(app, deps) {
       );
       return c.json(Workspace.parse(workspace));
     } catch (error) {
-      if (nestedPostgresSqlState13(error) === "0A000") {
+      if (nestedPostgresSqlState14(error) === "0A000") {
         throw new HTTPException108(409, {
           message: "Memory settings moved to Settings > Agent learning. Refresh the app to change them."
         });
@@ -124745,7 +124828,7 @@ function registerWorkspaceRoutes(app, deps) {
       if (error instanceof WorkspaceGatewayCustomModelLimitError || error instanceof WorkspaceGatewayCustomModelHistoryLimitError) {
         throw new HTTPException108(422, { message: error.message });
       }
-      if (nestedPostgresSqlState13(error) === "23505") {
+      if (nestedPostgresSqlState14(error) === "23505") {
         throw new HTTPException108(422, {
           message: "Gateway custom model already exists"
         });
@@ -124874,7 +124957,7 @@ function registerWorkspaceRoutes(app, deps) {
       if (error instanceof WorkspaceOpenRouterCustomModelLimitError || error instanceof WorkspaceOpenRouterCustomModelHistoryLimitError) {
         throw new HTTPException108(422, { message: error.message });
       }
-      if (nestedPostgresSqlState13(error) === "23505") {
+      if (nestedPostgresSqlState14(error) === "23505") {
         throw new HTTPException108(422, {
           message: "OpenRouter custom model already exists"
         });
@@ -125006,7 +125089,7 @@ function registerWorkspaceRoutes(app, deps) {
       if (error instanceof WorkspaceOpperCustomModelLimitError || error instanceof WorkspaceOpperCustomModelHistoryLimitError) {
         throw new HTTPException108(422, { message: error.message });
       }
-      if (nestedPostgresSqlState13(error) === "23505") {
+      if (nestedPostgresSqlState14(error) === "23505") {
         throw new HTTPException108(422, {
           message: "Opper custom model already exists"
         });
@@ -125494,7 +125577,7 @@ function rethrowWorkspaceMemberCandidateError(error) {
       message: "the workspace must keep at least one administrator"
     });
   }
-  const sqlState = nestedPostgresSqlState13(error);
+  const sqlState = nestedPostgresSqlState14(error);
   if (sqlState === "P0002") {
     throw new HTTPException108(404, { message: "workspace not found" });
   }
@@ -125559,7 +125642,7 @@ import {
   getWorkspace as getWorkspace7,
   getWorkspaceUsage,
   grantWorkspaceCredits,
-  nestedPostgresSqlState as nestedPostgresSqlState14,
+  nestedPostgresSqlState as nestedPostgresSqlState15,
   setMemberAllowance,
   setWorkspaceAllowance,
   withAccountRls as withAccountRls4,
@@ -125694,7 +125777,7 @@ async function lifecycle2(operation) {
   } catch (error) {
     if (error instanceof UsageAllowanceVersionConflictError)
       throw new HTTPException109(409, { message: error.message });
-    const state = nestedPostgresSqlState14(error);
+    const state = nestedPostgresSqlState15(error);
     if (state === "40001" || state === "23505")
       throw new HTTPException109(409, { message: "Allowance version or operation conflicts" });
     if (state === "42501")
@@ -126617,7 +126700,7 @@ import {
   WORKSPACE_STATE_KNOWLEDGE_SAMPLE_LIMIT as WORKSPACE_STATE_KNOWLEDGE_SAMPLE_LIMIT2
 } from "@opengeni/contracts";
 import {
-  hasPermission as hasPermission33,
+  hasPermission as hasPermission34,
   requireAccessGrant as requireAccessGrant52,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization33,
   knowledgeContextForAccess as knowledgeContextForAccess3
@@ -127234,7 +127317,7 @@ function registerCompanyBrainRoutes(app, deps) {
       workspaceId,
       accountId: grant.accountId,
       subjectId: grant.subjectId,
-      canInspectKnowledge: hasPermission33(grant.permissions, "documents:search"),
+      canInspectKnowledge: hasPermission34(grant.permissions, "documents:search"),
       access
     });
     context.header("cache-control", "private, no-store");
@@ -127253,7 +127336,7 @@ function registerCompanyBrainRoutes(app, deps) {
       workspaceId,
       accountId: grant.accountId,
       subjectId: grant.subjectId,
-      canInspectKnowledge: hasPermission33(grant.permissions, "documents:search"),
+      canInspectKnowledge: hasPermission34(grant.permissions, "documents:search"),
       access
     });
     context.header("cache-control", "private, no-store");
@@ -127446,7 +127529,7 @@ import {
 } from "@opengeni/core";
 import {
   availableSlackBotConnectionMetadata as availableSlackBotConnectionMetadata2,
-  nestedPostgresSqlState as nestedPostgresSqlState15,
+  nestedPostgresSqlState as nestedPostgresSqlState16,
   readOrganizationSlackBotAccess,
   setOrganizationSlackBotAccess,
   sharedOrganizationSlackBots as sharedOrganizationSlackBots2
@@ -127476,7 +127559,7 @@ function registerSlackBotAccessRoutes(app, deps) {
         )
       );
     } catch (error) {
-      if (nestedPostgresSqlState15(error) === "42501")
+      if (nestedPostgresSqlState16(error) === "42501")
         throw new HTTPException115(404, { message: "Local bot installation unavailable" });
       throw error;
     }
@@ -127530,7 +127613,7 @@ function registerSlackBotAccessRoutes(app, deps) {
       return context.json(OpenGeniSlackBotOrganizationAccess.parse(result2));
     } catch (error) {
       if (error instanceof HTTPException115) throw error;
-      if (nestedPostgresSqlState15(error) === "42501")
+      if (nestedPostgresSqlState16(error) === "42501")
         throw new HTTPException115(403, {
           message: "Organization administrator and a verified local bot installation required"
         });
@@ -127546,7 +127629,7 @@ import {
   WorkspaceStateResponse as WorkspaceStateResponse2
 } from "@opengeni/contracts";
 import {
-  hasPermission as hasPermission34,
+  hasPermission as hasPermission35,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization35,
   knowledgeContextForAccess as knowledgeContextForAccess4
 } from "@opengeni/core";
@@ -127605,7 +127688,7 @@ async function readWorkspaceState(deps, input) {
   const { workspaceId, query, access } = input;
   const { grant } = access;
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const canInspectKnowledge = hasPermission34(grant.permissions, "documents:search");
+  const canInspectKnowledge = hasPermission35(grant.permissions, "documents:search");
   const [workspace, policies, knowledge, currentPreferences, acceptedAttempt] = await Promise.all([
     getWorkspace9(deps.db, workspaceId),
     listWorkspaceInstructionPolicyRevisions3(deps.db, workspaceId, { limit: 1 }),
@@ -127732,7 +127815,7 @@ import {
   getWorkspaceArtifact as getWorkspaceArtifact3,
   getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef4,
   listWorkspaceArtifacts as listWorkspaceArtifacts2,
-  nestedPostgresSqlState as nestedPostgresSqlState16,
+  nestedPostgresSqlState as nestedPostgresSqlState17,
   publishWorkspaceArtifactVersion as publishWorkspaceArtifactVersion2,
   rollbackWorkspaceArtifact as rollbackWorkspaceArtifact2,
   setWorkspaceArtifactStatus as setWorkspaceArtifactStatus2,
@@ -127784,7 +127867,7 @@ function workspaceArtifactErrorResponse(context, error) {
       422
     );
   }
-  if (nestedPostgresSqlState16(error) === "23505") {
+  if (nestedPostgresSqlState17(error) === "23505") {
     return context.json(
       {
         code: "WORKSPACE_ARTIFACT_CONFLICT",
@@ -128685,6 +128768,9 @@ function registerSitePublishingRoutes(app, deps) {
 // src/routes/site-runtime.ts
 import { createHash as createHash37, randomBytes as randomBytes15, randomUUID as randomUUID16, timingSafeEqual as timingSafeEqual5 } from "crypto";
 import {
+  ReasoningEffort,
+  LatencyMode,
+  permissionsRequiredByFirstPartyTools as permissionsRequiredByFirstPartyTools4,
   DeleteSessionQueueItemRequest as DeleteSessionQueueItemRequest3,
   EditSessionQueueItemRequest as EditSessionQueueItemRequest3,
   matchSiteOperation,
@@ -128709,17 +128795,19 @@ import {
   ToolGatewayInvokeRequest
 } from "@opengeni/contracts";
 import {
+  cancelPublishedSiteSession,
   withHostSessionUsageLimit,
   withSiteSessionOrigin as withSiteSessionOrigin6,
   admissibleWorkspaceModel as admissibleWorkspaceModel2,
   loadWorkspaceModelSelectionInput as loadWorkspaceModelSelectionInput2,
   resolveWorkspaceModelSelection as resolveWorkspaceModelSelection4,
-  hasPermission as hasPermission35
+  hasPermission as hasPermission36
 } from "@opengeni/core";
 import {
   consumeSiteAuthCode,
   finishSiteRuntimeAdmission,
   withSiteRuntimeAdmission,
+  withSiteViewerRlsContext,
   createSiteAbuseReport,
   getSiteWorkspaceMemberPermissions,
   readSitePlatformUsage as readSitePlatformUsage2,
@@ -128742,13 +128830,16 @@ import {
 } from "@opengeni/db";
 
 // src/site-publishing/agent-session.ts
-import { resolveAgentConfig } from "@opengeni/contracts";
+import {
+  permissionsRequiredByFirstPartyTools as permissionsRequiredByFirstPartyTools3,
+  resolveAgentConfig
+} from "@opengeni/contracts";
 import { agentConfigDeploymentPolicy as agentConfigDeploymentPolicy2, resolveFirstPartyMcpToolPolicy as resolveFirstPartyMcpToolPolicy3 } from "@opengeni/config";
 import { siteSessionOriginFromMetadata as siteSessionOriginFromMetadata2 } from "@opengeni/core";
 import { appendSessionEventsWithLockedSessionUpdate, getSiteSqlDatabase as getSiteSqlDatabase3 } from "@opengeni/db";
 import { publishDurableSessionEvents as publishDurableSessionEvents5 } from "@opengeni/events";
-var SITE_AGENT_DEFAULTS_VERSION = 1;
-async function normalizeSiteAgentSession(deps, host, viewer, sessionId, retainedToolIds) {
+var SITE_AGENT_DEFAULTS_VERSION = 2;
+async function normalizeSiteAgentSession(deps, host, viewer, sessionId, retainedToolIds, memberPermissions) {
   const data = await resolveSiteAgentDataContext(deps, host.scope, sessionId);
   if (data.kind !== "site" || data.siteId !== host.site.id || data.viewer.principal !== viewer.principal)
     throw sitePublishingError(
@@ -128761,8 +128852,10 @@ async function normalizeSiteAgentSession(deps, host, viewer, sessionId, retained
   const dataTools = siteAgentDataToolNames({
     viewerKind: viewer.kind,
     siteSql: sqlEnabled,
-    allowed: resolveFirstPartyMcpToolPolicy3(deps.settings).allowed
+    allowed: resolveFirstPartyMcpToolPolicy3(deps.settings).allowed,
+    ...memberPermissions === void 0 ? {} : { memberPermissions }
   });
+  const dataToolPermissions = permissionsRequiredByFirstPartyTools3(dataTools);
   const config = resolveAgentConfig({
     creator: "api",
     request: {
@@ -128788,7 +128881,7 @@ async function normalizeSiteAgentSession(deps, host, viewer, sessionId, retained
     host.scope.workspaceId,
     sessionId,
     (session) => {
-      if (session.parentSessionId || session.createdBy.subjectId !== `site:${host.site.id}` || siteSessionOriginFromMetadata2(session.metadata)?.siteId !== host.site.id)
+      if (session.parentSessionId || session.createdBy.subjectId !== `site:${host.site.id}` && !(viewer.kind === "member" && session.createdBy.kind === "subject" && session.createdBy.subjectId === viewer.subjectId) || siteSessionOriginFromMetadata2(session.metadata)?.siteId !== host.site.id)
         throw sitePublishingError(
           403,
           "forbidden",
@@ -128797,7 +128890,8 @@ async function normalizeSiteAgentSession(deps, host, viewer, sessionId, retained
         );
       const raw = session.metadata.opengeniPublishedSite;
       const stamp = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
-      if (stamp.agentDefaultsVersion === SITE_AGENT_DEFAULTS_VERSION) return { events: [] };
+      if (stamp.agentDefaultsVersion === SITE_AGENT_DEFAULTS_VERSION && session.firstPartyMcpTools.join(",") === dataTools.join(",") && session.firstPartyMcpPermissions?.join(",") === dataToolPermissions.join(","))
+        return { events: [] };
       const allowed2 = /* @__PURE__ */ new Set(["opengeni", ...retainedToolIds]);
       const tools = session.tools.filter((tool) => allowed2.has(tool.id));
       const toolPolicy = {
@@ -128824,7 +128918,7 @@ async function normalizeSiteAgentSession(deps, host, viewer, sessionId, retained
         ],
         update: {
           firstPartyMcpTools: dataTools,
-          firstPartyMcpPermissions: [...SITE_AGENT_DATA_TOOL_PERMISSIONS],
+          firstPartyMcpPermissions: dataToolPermissions,
           agentConfig: config,
           instructions,
           tools,
@@ -129342,7 +129436,10 @@ var VersionId = z66.string().uuid();
 var ClientEventId = z66.string().min(1).max(200).optional();
 var CreateConversationRequest = z66.object({
   initialMessage: z66.string().trim().min(1).max(MESSAGE_MAX_CHARS),
-  idempotencyKey: z66.string().min(1).max(200).optional()
+  idempotencyKey: z66.string().min(1).max(200).optional(),
+  model: z66.string().min(1).optional(),
+  reasoningEffort: ReasoningEffort.optional(),
+  latencyMode: LatencyMode.optional()
 }).passthrough();
 var SendMessageRequest = z66.object({
   type: z66.literal("user.message"),
@@ -129531,7 +129628,7 @@ function idempotentSessionId(seed) {
 }
 function registerSiteRuntimeRoutes(app, deps) {
   const dispatch = async (request) => await app.fetch(markLocalInternalDispatch(request));
-  setSitePublishingDispatch(deps.settings, dispatch);
+  setSitePublishingCancellation(deps.settings, (input) => cancelPublishedSiteSession(deps, input));
   const handler = async (context) => {
     const domain = configuredSitesDomain(deps.settings);
     if (!domain || !deps.settings.sitesGatewaySecret)
@@ -129919,7 +130016,7 @@ function registerSiteRuntimeRoutes(app, deps) {
       agent = choice !== null && choice.kind !== "unavailable";
     }
     const version2 = host.site.currentVersionId ? await getPublishedSiteVersion6(deps.db, host.scope, host.site.id, host.site.currentVersionId) : null;
-    const workspaceTools = base.workspaceTools && (version2?.requestedTools.length ?? 0) > 0 && viewer.subjectId !== null && viewer.subjectId !== void 0 && hasPermission35(
+    const workspaceTools = base.workspaceTools && (version2?.requestedTools.length ?? 0) > 0 && viewer.subjectId !== null && viewer.subjectId !== void 0 && hasPermission36(
       await getSiteWorkspaceMemberPermissions(deps.db, host.scope, viewer.subjectId) ?? [],
       "workspace:read"
     );
@@ -130125,18 +130222,32 @@ function registerSiteRuntimeRoutes(app, deps) {
     const { context, url } = request;
     const base = `/v1/workspaces/${host.scope.workspaceId}/sessions`;
     const siteOrigin = { siteId: host.site.id, title: host.site.title, versionId: host.versionId };
+    const reauthorizeViewer = async () => {
+      const liveHost = await requireServedSiteRuntimeHost(deps, host.domain, request.fields.host);
+      const liveViewer = await resolveSiteRuntimeViewer(deps, liveHost, request.fields);
+      if (liveHost.site.id !== host.site.id || liveViewer.principal !== viewer.principal || liveViewer.kind !== viewer.kind || liveViewer.sessionId !== viewer.sessionId)
+        throw siteNotAvailableForViewer(
+          "agent",
+          "This conversation is no longer available to this viewer"
+        );
+    };
     let pendingAdmission;
     const send = async (method, path, body5, extraPermissions) => {
-      const execute = () => withSiteSessionOrigin6(
-        siteOrigin,
-        async () => dispatch(
-          await siteRuntimeSessionRequest(deps, host, viewer, {
-            origin: url.origin,
-            method,
-            path,
-            ...body5 === void 0 ? {} : { body: body5 },
-            ...extraPermissions ? { extraPermissions } : {}
-          })
+      await reauthorizeViewer();
+      const execute = () => withSiteViewerRlsContext(
+        { siteId: host.site.id, principal: viewer.principal },
+        () => withSiteSessionOrigin6(
+          siteOrigin,
+          async () => dispatch(
+            await siteRuntimeSessionRequest(deps, host, viewer, {
+              origin: url.origin,
+              method,
+              path,
+              reauthorize: reauthorizeViewer,
+              ...body5 === void 0 ? {} : { body: body5 },
+              ...extraPermissions ? { extraPermissions } : {}
+            })
+          )
         )
       );
       const pending2 = pendingAdmission;
@@ -130200,6 +130311,11 @@ function registerSiteRuntimeRoutes(app, deps) {
       if (viewer.kind === "guest" || viewer.kind === "user")
         await requireSitePlatformOpen(deps, "guest_agent");
       const models = await siteViewerModels(host, viewer, limits);
+      if (input.model && !models.allowed.includes(input.model))
+        throw siteNotAvailableForViewer(
+          "agent_model",
+          "This model is not available to you on this Site"
+        );
       if (models.unavailable)
         throw siteNotAvailableForViewer(
           "agent_model",
@@ -130248,6 +130364,11 @@ ${input.idempotencyKey}`) : randomUUID16();
           }
         }
       }
+      if (!repair && viewer.kind !== "member" && deps.settings.privacyOnlyMeAllowed === false)
+        throw siteNotAvailableForViewer(
+          "private_conversations",
+          "Private Site conversations are disabled by this deployment"
+        );
       for (const conversation2 of await listOwnedSiteRuntimeConversations(deps.db, host.scope, {
         siteId: host.site.id,
         viewerPrincipal: viewer.principal,
@@ -130286,8 +130407,10 @@ ${input.idempotencyKey}`) : randomUUID16();
         deps,
         host.scope,
         host.site.id,
-        viewer.kind
+        viewer.kind,
+        viewer.kind === "member" ? memberPermissions ?? [] : void 0
       );
+      const dataToolPermissions = permissionsRequiredByFirstPartyTools4(dataTools);
       const admissionId = randomUUID16();
       const reservation = await reserve(
         () => repair ? reserveSiteRuntimeConversationWork(deps.db, host.scope, {
@@ -130316,13 +130439,14 @@ ${input.idempotencyKey}`) : randomUUID16();
       const body5 = {
         initialMessage: input.initialMessage,
         requestedSessionId,
+        ...viewer.kind === "member" ? { visibility: "private" } : {},
         startMode: "standard",
         agentAccess: "session",
         memoryScope: "off",
         rigId: null,
         // Only this Site's data tools; never management or workspace tools.
         firstPartyMcpTools: dataTools,
-        ...dataTools.length > 0 ? { firstPartyMcpPermissions: [...SITE_AGENT_DATA_TOOL_PERMISSIONS] } : {},
+        ...dataTools.length > 0 ? { firstPartyMcpPermissions: dataToolPermissions } : {},
         agent: {
           capabilities: {
             from: "none",
@@ -130334,7 +130458,9 @@ ${input.idempotencyKey}`) : randomUUID16();
         // No sandbox: a Site's agent answers from the page and the Site's
         // data, with no shell or workspace files.
         sandboxBackend: "none",
-        ...repair ? { model: repair.model } : models.default ? { model: models.default } : {},
+        ...repair ? { model: repair.model } : input.model || models.default ? { model: input.model ?? models.default } : {},
+        ...input.reasoningEffort === void 0 ? {} : { reasoningEffort: input.reasoningEffort },
+        ...input.latencyMode === void 0 ? {} : { latencyMode: input.latencyMode },
         instructions: siteAgentInstructions(host, viewer, dataTools, agent.instructions),
         // Always explicit: an empty list means no workspace tools at all.
         tools: mcpTools,
@@ -130348,7 +130474,7 @@ ${input.idempotencyKey}`) : randomUUID16();
         },
         ...input.idempotencyKey ? { idempotencyKey: `site-runtime:${requestedSessionId}` } : {}
       };
-      const start = () => send("POST", base, body5, dataTools.length > 0 ? SITE_AGENT_DATA_TOOL_PERMISSIONS : []);
+      const start = () => send("POST", base, body5, dataToolPermissions);
       const usageLimitMicros = viewer.kind === "member" || repair ? null : reservation.executionLimitMicros;
       let created;
       try {
@@ -130462,7 +130588,8 @@ ${input.idempotencyKey}`) : randomUUID16();
         host,
         viewer,
         conversation.sessionId,
-        conversation.toolIds
+        conversation.toolIds,
+        viewer.kind === "member" ? memberPermissions ?? [] : void 0
       );
       const usage = await settleSiteRuntimeSpend(deps, host, conversation);
       if (viewer.kind === "member" && conversation.limitMicros !== null)
@@ -130687,7 +130814,7 @@ import {
   editableArtifactScope as editableArtifactScope2,
   fileOwnerContextForAccess as fileOwnerContextForAccess5,
   grantHasAgentAttemptAuthority as grantHasAgentAttemptAuthority5,
-  hasPermission as hasPermission36,
+  hasPermission as hasPermission37,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization37,
   requireLiveAgentAttemptAuthorization as requireLiveAgentAttemptAuthorization8,
   requireSessionAuthorization as requireSessionAuthorization18,
@@ -130698,10 +130825,10 @@ import {
 import {
   getFilesForSubject as getFilesForSubject3,
   getGeneratedImageArtifact as getGeneratedImageArtifact2,
-  getSessionAuthorityProjection as getSessionAuthorityProjection3,
+  getSessionAuthorityProjection as getSessionAuthorityProjection4,
   isWorkspaceArtifactVisible,
   listArtifactCatalogCandidates,
-  nestedPostgresSqlState as nestedPostgresSqlState17,
+  nestedPostgresSqlState as nestedPostgresSqlState18,
   updateArtifactPin,
   withSessionRlsActorContext as withSessionRlsActorContext10
 } from "@opengeni/db";
@@ -130782,7 +130909,7 @@ function registerArtifactCatalogRoutes(app, deps) {
       "artifacts:publish"
     );
     const grant = authorization.grant;
-    if (!hasPermission36(grant.permissions, "artifacts:publish"))
+    if (!hasPermission37(grant.permissions, "artifacts:publish"))
       throw new HTTPException119(403, { message: "Artifact publish access required" });
     const kind = ArtifactCatalogKind3.safeParse(context.req.param("kind"));
     const body5 = UpdateArtifactPinRequest.safeParse(await context.req.json().catch(() => null));
@@ -130791,7 +130918,7 @@ function registerArtifactCatalogRoutes(app, deps) {
       throw new HTTPException119(422, { message: "Invalid artifact pin request" });
     const artifactId2 = editableKinds.has(kind.data) ? requestedId : requestedId.toLowerCase();
     const fileKind = kind.data === "file" || kind.data === "image";
-    if (!hasPermission36(grant.permissions, fileKind ? "files:read" : "artifacts:read"))
+    if (!hasPermission37(grant.permissions, fileKind ? "files:read" : "artifacts:read"))
       throw new HTTPException119(403, { message: "Artifact read access required" });
     const actor = fileKind ? await fileOwnerContextForAccess5(deps, authorization, "files:read") : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
     context.header("cache-control", "private, no-store");
@@ -130843,7 +130970,7 @@ function registerArtifactCatalogRoutes(app, deps) {
           }
         );
       } catch (error) {
-        if (nestedPostgresSqlState17(error) === "42501")
+        if (nestedPostgresSqlState18(error) === "42501")
           throw new HTTPException119(404, { message: "Artifact not found" });
         throw error;
       }
@@ -130860,8 +130987,8 @@ function registerArtifactCatalogRoutes(app, deps) {
     if (!parsed.success)
       throw new HTTPException119(422, { message: "Invalid artifact catalog query" });
     const query = parsed.data;
-    const artifactsAllowed = hasPermission36(grant.permissions, "artifacts:read");
-    const filesAllowed = hasPermission36(grant.permissions, "files:read");
+    const artifactsAllowed = hasPermission37(grant.permissions, "artifacts:read");
+    const filesAllowed = hasPermission37(grant.permissions, "files:read");
     if (!artifactsAllowed && !filesAllowed)
       throw new HTTPException119(403, { message: "Artifact catalog read access required" });
     let kinds = ArtifactCatalogKind3.options.filter(
@@ -130889,7 +131016,7 @@ function registerArtifactCatalogRoutes(app, deps) {
     }
     const sourceDecisions = /* @__PURE__ */ new Map();
     const canReadSession = async (sessionId) => {
-      if (!hasPermission36(grant.permissions, "sessions:read")) return false;
+      if (!hasPermission37(grant.permissions, "sessions:read")) return false;
       if (sourceDecisions.has(sessionId)) return sourceDecisions.get(sessionId);
       try {
         await requireSessionAuthorization18(deps, grant, {
@@ -130897,7 +131024,7 @@ function registerArtifactCatalogRoutes(app, deps) {
           operation: "session.read",
           surface: "http"
         });
-        if (!await getSessionAuthorityProjection3(deps.db, workspaceId, sessionId)) {
+        if (!await getSessionAuthorityProjection4(deps.db, workspaceId, sessionId)) {
           sourceDecisions.set(sessionId, false);
           return false;
         }
@@ -131176,6 +131303,8 @@ function registerInsightsRoutes(app, deps) {
 import {
   InsightsCallsResponse,
   InsightsUsageResponse,
+  InsightsSiteUsageQuery,
+  InsightsSiteUsageResponse,
   OrganizationInsightsCallsQuery,
   OrganizationInsightsUsageQuery,
   WorkspaceInsightsCallsQuery,
@@ -131184,10 +131313,12 @@ import {
 import {
   accountScopedApiKeyWorkspaceAuthority as accountScopedApiKeyWorkspaceAuthority7,
   getInsightsUsage,
-  hasPermission as hasPermission37,
+  getInsightsSiteUsage,
+  hasPermission as hasPermission38,
   listInsightsCalls,
   requireAccessContext as requireAccessContext15,
-  requireAccessGrant as requireAccessGrant58
+  requireAccessGrant as requireAccessGrant58,
+  siteViewerForGrant as siteViewerForGrant10
 } from "@opengeni/core";
 import {
   currentSessionRlsActorIdentityKey as currentSessionRlsActorIdentityKey2,
@@ -131325,7 +131456,7 @@ function insightsUsageCoalesceKey(scope, query, actor) {
 function organizationInsightsScope(context, accountId) {
   const authority = accountScopedApiKeyWorkspaceAuthority7(context);
   if (authority?.accountId === accountId) {
-    const readable = hasPermission37(
+    const readable = hasPermission38(
       authority.permissions,
       "sessions:read",
       authority.permissionMode
@@ -131343,7 +131474,7 @@ function organizationInsightsScope(context, accountId) {
     detailsWorkspaceIds: [
       ...new Set(
         context.workspaceGrants.filter(
-          (grant) => grant.accountId === accountId && grant.subjectId === context.subjectId && hasPermission37(grant.permissions, "sessions:read", grant.permissionMode)
+          (grant) => grant.accountId === accountId && grant.subjectId === context.subjectId && hasPermission38(grant.permissions, "sessions:read", grant.permissionMode)
         ).map((grant) => grant.workspaceId)
       )
     ].sort(),
@@ -131389,6 +131520,23 @@ function registerInsightsUsageRoutes(app, deps) {
       return response;
     });
   }
+  app.get("/v1/workspaces/:workspaceId/insights/sites", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant58(c, deps, workspaceId, "workspace:admin");
+    const query = InsightsSiteUsageQuery.safeParse(insightsQueryParameters(c.req.queries()));
+    if (!query.success) throw new HTTPException122(400, { message: "invalid Site Insights query" });
+    const viewer = await siteViewerForGrant10(deps.db, grant);
+    const response = await insightsWithFriendlyTimeout(
+      () => getInsightsSiteUsage(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        query: query.data,
+        viewerSubjectId: viewer.subjectId
+      })
+    );
+    c.header("cache-control", "private, no-store");
+    return c.json(InsightsSiteUsageResponse.parse(response));
+  });
   app.get("/v1/workspaces/:workspaceId/insights/usage", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant58(c, deps, workspaceId, "workspace:admin");
@@ -131400,7 +131548,7 @@ function registerInsightsUsageRoutes(app, deps) {
     const scope = {
       accountId: grant.accountId,
       workspaceId,
-      detailsWorkspaceIds: hasPermission37(grant.permissions, "sessions:read", grant.permissionMode) ? [workspaceId] : []
+      detailsWorkspaceIds: hasPermission38(grant.permissions, "sessions:read", grant.permissionMode) ? [workspaceId] : []
     };
     const response = await cached(
       c,
@@ -131426,7 +131574,7 @@ function registerInsightsUsageRoutes(app, deps) {
     const scope = {
       accountId: grant.accountId,
       workspaceId,
-      detailsWorkspaceIds: hasPermission37(grant.permissions, "sessions:read", grant.permissionMode) ? [workspaceId] : []
+      detailsWorkspaceIds: hasPermission38(grant.permissions, "sessions:read", grant.permissionMode) ? [workspaceId] : []
     };
     const response = await cached(
       c,
@@ -132674,7 +132822,7 @@ import {
 } from "@opengeni/core";
 
 // src/model-calls/chat-completions.ts
-import { ReasoningEffort } from "@opengeni/contracts";
+import { ReasoningEffort as ReasoningEffort2 } from "@opengeni/contracts";
 import { ModelCallError } from "@opengeni/core";
 import {
   normalizeModelCallUsage
@@ -132715,7 +132863,7 @@ var ChatCompletionRequest = z69.object({
   temperature: z69.number().min(0).max(2).nullish(),
   top_p: z69.number().min(0).max(1).nullish(),
   stop: z69.union([z69.string(), z69.array(z69.string()).max(4)]).nullish(),
-  reasoning_effort: ReasoningEffort.nullish(),
+  reasoning_effort: ReasoningEffort2.nullish(),
   verbosity: z69.enum(["low", "medium", "high"]).nullish(),
   response_format: z69.object({ type: z69.string() }).passthrough().nullish(),
   stream: z69.boolean().nullish(),
@@ -133784,7 +133932,7 @@ import {
   requireSessionAuthorization as requireSessionAuthorization19,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError18,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError16,
-  siteViewerForGrant as siteViewerForGrant10
+  siteViewerForGrant as siteViewerForGrant11
 } from "@opengeni/core";
 import {
   getGeneratedImageArtifact as getGeneratedImageArtifact3,
@@ -133838,7 +133986,7 @@ function registerSessionArtifactAssociationRoutes(app, deps) {
           ) : await hasWorkspaceArtifactSessionLink(
             deps.db,
             workspaceId,
-            await siteViewerForGrant10(deps.db, grant),
+            await siteViewerForGrant11(deps.db, grant),
             sessionId,
             artifactId2
           );
@@ -134140,7 +134288,7 @@ import {
   StartManagedAuthSocialTransactionRequest,
   StartManagedAuthSocialTransactionResponse
 } from "@opengeni/contracts/managed-auth-session-sets";
-import { hasPermission as hasPermission38, requireSessionAuthorization as requireSessionAuthorization20 } from "@opengeni/core";
+import { hasPermission as hasPermission39, requireSessionAuthorization as requireSessionAuthorization20 } from "@opengeni/core";
 import {
   authenticateAndAdoptManagedAuthSession,
   isolatedManagedAuthHeaders,
@@ -134823,7 +134971,7 @@ async function resolveCanonicalDeepLink(deps, authority, path, expectedActorEpoc
     const grants = target.workspaceId ? access.workspaceGrants.filter((grant) => grant.workspaceId === target.workspaceId) : access.workspaceGrants;
     let authorized = false;
     for (const grant of grants) {
-      if (!hasPermission38(grant.permissions, target.sessionId ? "sessions:read" : target.permission)) {
+      if (!hasPermission39(grant.permissions, target.sessionId ? "sessions:read" : target.permission)) {
         continue;
       }
       if (target.sessionId) {
@@ -135679,7 +135827,7 @@ import {
   getManagedSession as getManagedSession5,
   accountScopedApiKeyWorkspaceAuthority as accountScopedApiKeyWorkspaceAuthority8,
   organizationWorkspaceInScope as organizationWorkspaceInScope3,
-  hasPermission as hasPermission39,
+  hasPermission as hasPermission40,
   requireAccessContext as requireAccessContext16,
   organizationMembershipHttpStatus,
   requireCanonicalLocalAccountAdministrator as requireCanonicalLocalAccountAdministrator4,
@@ -135703,7 +135851,7 @@ import {
   listOrganizationAdministrationMembers as listOrganizationAdministrationMembers2,
   listOrganizationInvitations,
   listSelfOrganizationInvitations,
-  nestedPostgresSqlState as nestedPostgresSqlState18,
+  nestedPostgresSqlState as nestedPostgresSqlState19,
   prepareOrganizationUserSetupDelivery,
   revokeOrganizationInvitation,
   settleOrganizationUserSetupDelivery,
@@ -135747,7 +135895,7 @@ async function requirePrivateSessionAdministrator(context, deps, organizationId2
 async function requireOrganizationKeyWorkspaceDeletion(context, deps, organizationId2, workspaceId) {
   const access = await requireAccessContext16(context, deps);
   const key2 = accountScopedApiKeyWorkspaceAuthority8(access);
-  if (!key2 || key2.accountId !== organizationId2 || !hasPermission39(key2.permissions, "workspace:admin")) {
+  if (!key2 || key2.accountId !== organizationId2 || !hasPermission40(key2.permissions, "workspace:admin")) {
     throw new HTTPException128(403, {
       message: "deleting an organization workspace requires an organization owner session or an organization API key with workspace:admin"
     });
@@ -135820,7 +135968,7 @@ function parseId3(schema, value, label) {
   return parsed.data;
 }
 function rethrowMembershipError(error, resourceLimitMessage) {
-  const sqlState = nestedPostgresSqlState18(error);
+  const sqlState = nestedPostgresSqlState19(error);
   if (sqlState === "54000" && resourceLimitMessage) {
     throw new HTTPException128(409, {
       message: resourceLimitMessage
@@ -135926,7 +136074,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
         })
       );
     } catch (error) {
-      if (nestedPostgresSqlState18(error) === "42501") {
+      if (nestedPostgresSqlState19(error) === "42501") {
         throw new HTTPException128(403, {
           message: "organization membership is not active"
         });
@@ -136615,7 +136763,7 @@ import {
 import {
   accountScopedApiKeyWorkspaceAuthority as accountScopedApiKeyWorkspaceAuthority9,
   organizationWorkspaceInScope as organizationWorkspaceInScope4,
-  hasPermission as hasPermission40,
+  hasPermission as hasPermission41,
   requireAccessContext as requireAccessContext17,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization40,
   requireSessionAuthorizationListScope as requireSessionAuthorizationListScope3,
@@ -136660,7 +136808,7 @@ function decodeOrganizationSessionListCursor(value) {
 function requireOrganizationSessionReadAuthority(context, organizationId2) {
   const authority = accountScopedApiKeyWorkspaceAuthority9(context);
   if (authority) {
-    if (authority.accountId === organizationId2 && hasPermission40(authority.permissions, "sessions:read")) {
+    if (authority.accountId === organizationId2 && hasPermission41(authority.permissions, "sessions:read")) {
       return "organization_api_key";
     }
     throw new HTTPException129(403, { message: "organization session read authority required" });
@@ -137125,7 +137273,7 @@ import {
   completeSelfServiceOrganizationSetup,
   completeOrganizationUserSetup,
   getSelfServiceOrganizationOnboardingState,
-  nestedPostgresSqlState as nestedPostgresSqlState19,
+  nestedPostgresSqlState as nestedPostgresSqlState20,
   preflightOrganizationUserSetup,
   previewOrganizationUserSetup,
   recordOrganizationSignupUseCase
@@ -137183,14 +137331,14 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
           useCase: parsed.data.useCase
         }).catch((error) => {
           console.warn("[api] could not record the signup use case", {
-            sqlState: nestedPostgresSqlState19(error) ?? null
+            sqlState: nestedPostgresSqlState20(error) ?? null
           });
         });
       }
       return context.json(completed);
     } catch (error) {
       recordOrganizationSetupOutcome(deps.observability, "failed");
-      const sqlState = nestedPostgresSqlState19(error);
+      const sqlState = nestedPostgresSqlState20(error);
       if (sqlState === "22023") {
         throw new HTTPException131(422, {
           message: "invalid organization setup request"
@@ -137270,7 +137418,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
         )
       );
     } catch (error) {
-      const sqlState = nestedPostgresSqlState19(error);
+      const sqlState = nestedPostgresSqlState20(error);
       if (sqlState === "22023") {
         throw new HTTPException131(422, {
           message: "invalid account setup request"
@@ -137635,7 +137783,7 @@ import {
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError18,
   SessionTenancyManagedHumanRequiredError as SessionTenancyManagedHumanRequiredError3
 } from "@opengeni/core";
-import { nestedPostgresSqlState as nestedPostgresSqlState20, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
+import { nestedPostgresSqlState as nestedPostgresSqlState21, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
 import { HTTPException as HTTPException133 } from "hono/http-exception";
 import { z as z78 } from "zod";
 async function body4(context, schema) {
@@ -137650,10 +137798,10 @@ function lifecycleError(error) {
   if (error instanceof SessionAuthorizationUnavailableError18) {
     throw new HTTPException133(503, { message: "session authorization unavailable" });
   }
-  if (nestedPostgresSqlState20(error) === "42501") {
+  if (nestedPostgresSqlState21(error) === "42501") {
     throw new HTTPException133(403, { message: "user-resource authority denied" });
   }
-  if (nestedPostgresSqlState20(error) === "22023") {
+  if (nestedPostgresSqlState21(error) === "22023") {
     throw new HTTPException133(422, { message: "invalid user-resource request" });
   }
   throw error;
@@ -138964,7 +139112,7 @@ import {
   controlHumanSessionWorkstream as controlHumanSessionWorkstream2,
   createSessionForRequest as createSessionForRequest2,
   getActorNewSessionModelChoice,
-  hasPermission as hasPermission42,
+  hasPermission as hasPermission43,
   requireAccessContext as requireAccessContext18,
   requireAccessGrant as requireAccessGrant63,
   requireSessionAuthorizationListScope as requireSessionAuthorizationListScope4,
@@ -138978,7 +139126,7 @@ import {
   resourceMountPathCollisionKey
 } from "@opengeni/contracts";
 import { listRecentSessionRepositoryResources } from "@opengeni/db";
-import { hasPermission as hasPermission41 } from "@opengeni/core";
+import { hasPermission as hasPermission42 } from "@opengeni/core";
 var SLACK_SESSION_RECENT_REPOSITORY_LIMIT = 5;
 var SLACK_SESSION_RECENT_REPOSITORY_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
 function githubUriKey(uri) {
@@ -139043,7 +139191,7 @@ function selectRecentRepositoryResources(recent, catalog, limit = SLACK_SESSION_
   return resources;
 }
 async function slackRecentRepositoryResources(deps, grant, workspaceId, now = /* @__PURE__ */ new Date()) {
-  if (!hasPermission41(grant.permissions, "github:use")) return [];
+  if (!hasPermission42(grant.permissions, "github:use")) return [];
   const recent = await listRecentSessionRepositoryResources(deps.db, {
     workspaceId,
     subjectId: grant.subjectId,
@@ -140346,7 +140494,7 @@ function registerSlackInteractionRoutes(app, deps) {
         targetAccountId: grant.accountId,
         targetWorkspaceId: route2.targetWorkspaceId
       });
-      if (!authorized || !hasPermission42(authorized.permissions, "sessions:create")) {
+      if (!authorized || !hasPermission43(authorized.permissions, "sessions:create")) {
         throw new HTTPException134(403, {
           message: `you cannot start work in the workspace chosen for ${route2.slackChannelId}`
         });
@@ -140429,7 +140577,7 @@ async function publishSlackAppHome(deps, installation, refresh, renewLease) {
   const grant = link ? await getWorkspaceGrant5(deps.db, link.subjectId, installation.workspaceId, {
     principalKind: "human_session"
   }) : null;
-  if (!grant || grant.accountId !== installation.accountId || !hasPermission42(grant.permissions, "sessions:read")) {
+  if (!grant || grant.accountId !== installation.accountId || !hasPermission43(grant.permissions, "sessions:read")) {
     const client2 = await createOpenGeniSlackBotInteractionClient(deps, {
       accountId: installation.accountId,
       workspaceId: installation.workspaceId,
@@ -140507,7 +140655,7 @@ async function publishSlackAppHome(deps, installation, refresh, renewLease) {
   const currentGrant = currentLink ? await getWorkspaceGrant5(deps.db, currentLink.subjectId, installation.workspaceId, {
     principalKind: "human_session"
   }) : null;
-  if (!currentLink || currentLink.subjectId !== grant.subjectId || !currentGrant || currentGrant.accountId !== installation.accountId || !hasPermission42(currentGrant.permissions, "sessions:read")) {
+  if (!currentLink || currentLink.subjectId !== grant.subjectId || !currentGrant || currentGrant.accountId !== installation.accountId || !hasPermission43(currentGrant.permissions, "sessions:read")) {
     await publishSlackAppHomeAccessView(
       client,
       refresh,
@@ -141060,7 +141208,7 @@ async function handleSlackRouteChoice(deps, home, entry2, actionId, optionId) {
     targetAccountId: chosen.candidateAccountId,
     targetWorkspaceId: chosen.candidateWorkspaceId
   }) : null;
-  if (!grant || !hasPermission42(grant.permissions, "sessions:create")) {
+  if (!grant || !hasPermission43(grant.permissions, "sessions:create")) {
     await client.postMessage({
       operationId: deterministicUuid2(`slack-route-denied:${prompt.id}:${chosen.id}`),
       userId: entry2.slackUserId,
@@ -141269,7 +141417,7 @@ async function processSlackInboxEntry(deps, entry2) {
     });
     return;
   }
-  if (!hasPermission42(grant.permissions, "sessions:create")) {
+  if (!hasPermission43(grant.permissions, "sessions:create")) {
     throw new SlackInteractionPermanentError("sessions_create_denied");
   }
   const { interaction } = await getOrCreateSlackInteraction(deps.db, {
@@ -141719,7 +141867,7 @@ async function processSlackReactionInboxEntry(deps, entry2) {
     if (!resolved) {
       throw new SlackInteractionPermanentError("identity_access_revoked");
     }
-    if (!hasPermission42(resolved.permissions, "sessions:create") || !hasPermission42(resolved.permissions, "sessions:control")) {
+    if (!hasPermission43(resolved.permissions, "sessions:create") || !hasPermission43(resolved.permissions, "sessions:control")) {
       throw new SlackInteractionPermanentError("reaction_session_permissions_denied");
     }
     return resolved;
@@ -142264,7 +142412,7 @@ async function continueSlackSession(deps, grant, interaction, entry2, resources
   const sessionId = interaction.sessionId;
   await reopenSlackInteractionDelivery(deps.db, interaction);
   if (entry2.text.trim().toLowerCase() === "stop") {
-    if (!hasPermission42(grant.permissions, "sessions:control")) {
+    if (!hasPermission43(grant.permissions, "sessions:control")) {
       throw new SlackInteractionPermanentError("sessions_control_denied");
     }
     await controlHumanSessionWorkstream2(
@@ -142343,7 +142491,7 @@ async function continueSlackSession(deps, grant, interaction, entry2, resources
       }
     }
   }
-  if (!hasPermission42(grant.permissions, "sessions:control")) {
+  if (!hasPermission43(grant.permissions, "sessions:control")) {
     throw new SlackInteractionPermanentError("sessions_control_denied");
   }
   await withSlackAllowanceAdmissionNotice(deps, entry2, interaction, async () => {
@@ -142455,7 +142603,7 @@ async function processSlackBlockAction(deps, entry2) {
     targetAccountId: target.accountId,
     targetWorkspaceId: target.workspaceId
   });
-  if (!grant || !hasPermission42(grant.permissions, "sessions:control")) {
+  if (!grant || !hasPermission43(grant.permissions, "sessions:control")) {
     throw new SlackInteractionPermanentError("sessions_control_denied");
   }
   const client = await createOpenGeniSlackBotInteractionClient(deps, {
@@ -142815,7 +142963,7 @@ async function executeSlackAction(deps, grant, interaction, handle) {
   }
   const session = await getSession18(deps.db, grant.workspaceId, handle.sessionId);
   if (!session) throw new SlackInteractionPermanentError("slack_action_session_missing");
-  const recurring = hasPermission42(grant.permissions, "sessions:read") && hasPermission42(grant.permissions, "scheduled_tasks:manage") ? makeRecurringText(deps, grant.workspaceId, handle.sessionId) : null;
+  const recurring = hasPermission43(grant.permissions, "sessions:read") && hasPermission43(grant.permissions, "scheduled_tasks:manage") ? makeRecurringText(deps, grant.workspaceId, handle.sessionId) : null;
   return {
     result: "status",
     text: `${mention}Opengeni task status: *${session.status.replaceAll("_", " ")}*.${recurring ? `
@@ -143902,7 +144050,7 @@ async function slackInfoCommandResponse(deps, installation, entry2) {
   const grant = link ? await getWorkspaceGrant5(deps.db, link.subjectId, installation.workspaceId, {
     principalKind: "human_session"
   }) : null;
-  if (!grant || grant.accountId !== installation.accountId || !hasPermission42(grant.permissions, "sessions:read")) {
+  if (!grant || grant.accountId !== installation.accountId || !hasPermission43(grant.permissions, "sessions:read")) {
     return ephemeralSlackResponse(
       link ? `Your Slack identity is linked, but it does not currently have access to this Opengeni workspace. Request access: ${linkUrl(deps, identity2)}. No session was created.` : `Link your Slack identity to Opengeni before starting work: ${linkUrl(deps, identity2)}. No session was created.`
     );
@@ -143910,9 +144058,9 @@ async function slackInfoCommandResponse(deps, installation, entry2) {
   const workspace = await getWorkspace15(deps.db, installation.workspaceId);
   const command = deps.settings.slackCommand;
   const botMention = slackBotMention(installation.botUserId);
-  const canControl = hasPermission42(grant.permissions, "sessions:control");
-  const canCreate = hasPermission42(grant.permissions, "sessions:create");
-  const canSchedule = hasPermission42(grant.permissions, "scheduled_tasks:manage");
+  const canControl = hasPermission43(grant.permissions, "sessions:control");
+  const canCreate = hasPermission43(grant.permissions, "sessions:create");
+  const canSchedule = hasPermission43(grant.permissions, "scheduled_tasks:manage");
   const schedules = canSchedule ? slackSchedulesUrl(deps, installation.workspaceId) : null;
   const agentSchedules = canSchedule && canControl && slackTaskFirstPartyMcpTools(deps.settings, workspace?.settings).includes(
     "scheduled_tasks_create"
@@ -145058,7 +145206,7 @@ function createAppComposition(deps) {
             { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
             { observeAvailability: true }
           );
-          if (!hasPermission43(grant.permissions, "sessions:create")) {
+          if (!hasPermission44(grant.permissions, "sessions:create")) {
             modelSelectionForbidden = true;
             selections = [];
           }
@@ -145072,7 +145220,7 @@ function createAppComposition(deps) {
             preferredProvider: voicePreferences?.preferredProvider,
             fallbackEnabled: voicePreferences?.fallbackEnabled
           };
-          if (hasPermission43(grant.permissions, "sessions:create") && transcription) {
+          if (hasPermission44(grant.permissions, "sessions:create") && transcription) {
             voiceInputProviders = await transcription.availableProviderIds?.(voiceContext) ?? [];
             voiceInputAvailable = voiceInputProviders.length > 0 && await Promise.resolve(transcription.available(voiceContext)).catch(() => false);
           }
@@ -145367,8 +145515,8 @@ function createAppComposition(deps) {
       throw error;
     }
     const grant = authorization.grant;
-    const outsideAgentContext = AsyncLocalStorage3.snapshot();
-    return await withSessionAuthorizationReadReuse(
+    const outsideAgentContext = AsyncLocalStorage4.snapshot();
+    return await withSessionAuthorizationReadReuse3(
       (reads) => withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
         const boundSessionId = grant.metadata?.sessionId;
         if (typeof boundSessionId === "string") {
@@ -145465,7 +145613,7 @@ function createAppComposition(deps) {
         reauthorize: async () => {
           const live = await requireFreshAccessGrant5(c, routeDeps, workspaceId, "workspace:read");
           const original = authorization.grant;
-          if (live.accountId !== original.accountId || live.subjectId !== original.subjectId || live.principalKind !== original.principalKind || original.permissions.some((permission) => !hasPermission43(live.permissions, permission)))
+          if (live.accountId !== original.accountId || live.subjectId !== original.subjectId || live.principalKind !== original.principalKind || original.permissions.some((permission) => !hasPermission44(live.permissions, permission)))
             throw new HTTPException135(403, { message: "tool_access_changed" });
         },
         onFence: (created) => {
@@ -145919,7 +146067,7 @@ async function validateCodexAccountTarget(request) {
 async function requireMcpAccessGrantAuthorization(c, deps, workspaceId) {
   const authorization = await requireAccessGrantAuthorization42(c, deps, workspaceId);
   const grant = authorization.grant;
-  if (hasPermission43(grant.permissions, "workspace:read")) {
+  if (hasPermission44(grant.permissions, "workspace:read")) {
     return authorization;
   }
   if (isCodemodeGrant(grant)) {
@@ -147351,4 +147499,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-PQBHZ2YH.js.map
+//# sourceMappingURL=chunk-6CECHDZP.js.map