@opengeni/api-router 3.2.2 → 3.3.0

package/dist/mcp/scheduled-task-view.d.ts

@@ -83,8 +83,8 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -221,8 +221,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -408,8 +408,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -601,8 +601,8 @@ export declare function boundScheduledTaskMcpPage(input: {
         runMode: "existing_session" | "new_session_per_run" | "reusable_session";
         overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
         action: {
-            readonly sourceId?: never;
             kind: "agent_turn";
+            sourceId?: never;
             sourceGeneration?: never;
             sourceLifecycleGeneration?: never;
             destination?: never;

package/dist/sandbox/channel-a.d.ts

@@ -1,6 +1,6 @@
 import { type Settings } from "@opengeni/config";
 import type { AccessGrant, Session } from "@opengeni/contracts";
-import { type Database, type LeaseSnapshot } from "@opengeni/db";
+import { type Database, type EnrollmentRecord, type LeaseSnapshot } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import { type Observability } from "@opengeni/observability";
 import type { ObjectStorage } from "@opengeni/storage";
@@ -56,6 +56,15 @@ export type ChannelAHandle = {
      * who started an agent's turn, or the calling person. Routes that look up
      * the routed machine again must use it rather than the raw caller grant. */
     machineAuthority: () => Promise<ChannelAMachineAuthority>;
+    /** For a machine-home request, the Connected Machine and live runner this
+     * request was pinned to under `machineAuthority`. The routing session fails
+     * rather than follow a changed pointer, so a route that resolved this same
+     * sandbox can use it instead of looking the machine up again. */
+    pinnedMachine: {
+        sandboxId: string;
+        sandboxWorkspaceId: string;
+        enrollment: EnrollmentRecord;
+    } | null;
     requestId: string;
 };
 export type EstablishedHandleCacheKind = "read" | "process" | "none";

package/dist/site-publishing/agent-data-tools.d.ts

@@ -1,5 +1,5 @@
-import { type FirstPartyMcpToolName, type SiteLimitProfileKind } from "@opengeni/contracts";
-import type { ApiRouteDeps } from "@opengeni/core";
+import { type FirstPartyMcpToolName, type Permission, type SiteLimitProfileKind } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
 import { type SiteRuntimeConversationViewerKind } from "@opengeni/db";
 import type { PublishedSiteDataViewer } from "../site-data/service.js";
 import { type SiteRuntimeHost } from "./runtime.js";
@@ -21,8 +21,6 @@ import { type SiteRuntimeHost } from "./runtime.js";
 export declare const SITE_AGENT_DATA_TOOLS: readonly ["site_data_query", "site_data_write"];
 export declare const SITE_AGENT_SQL_TOOLS: readonly ["site_sql_run"];
 export declare const SITE_AGENT_MEMBER_SQL_TOOLS: readonly ["site_sql_query"];
-/** The first-party permissions those tools need (Site Data writes need publish). */
-export declare const SITE_AGENT_DATA_TOOL_PERMISSIONS: readonly ["artifacts:read", "artifacts:publish"];
 export declare const SITE_AGENT_OTHER_SITE_MESSAGE = "This Site's assistant can only use this Site's data";
 export declare const SITE_AGENT_MANAGEMENT_MESSAGE = "This Site's assistant can use the Site's data, not manage the Site";
 /** The data tools one viewer's Site agent conversation gets, within the deployment's tools. */
@@ -32,6 +30,8 @@ export declare function siteAgentDataToolNames(input: {
     siteSql: boolean;
     /** The deployment's first-party tool allowlist. */
     allowed: readonly string[];
+    /** Live member ceiling; omitted only where the native caller filters tools itself. */
+    memberPermissions?: readonly Permission[];
 }): FirstPartyMcpToolName[];
 /** Whether Site SQL is offered on this deployment and turned on for the Site. */
 export declare function siteAgentSiteSqlOn(deps: Pick<ApiRouteDeps, "db" | "settings">, scope: {
@@ -42,7 +42,7 @@ export declare function siteAgentSiteSqlOn(deps: Pick<ApiRouteDeps, "db" | "sett
 export declare function siteAgentDataToolsForStart(deps: Pick<ApiRouteDeps, "db" | "settings">, scope: {
     accountId: string;
     workspaceId: string;
-}, siteId: string, viewerKind: SiteRuntimeConversationViewerKind): Promise<FirstPartyMcpToolName[]>;
+}, siteId: string, viewerKind: SiteRuntimeConversationViewerKind, memberPermissions?: readonly Permission[]): Promise<FirstPartyMcpToolName[]>;
 /** This Site's viewer (`user:<subject>` or `guest:<visitor>`) as Site Data and Site SQL see it. */
 export declare function sitePublishedDataViewer(host: Pick<SiteRuntimeHost, "scope" | "site">, principal: string, guest: boolean): PublishedSiteDataViewer;
 /**

package/dist/site-publishing/agent-session.d.ts

@@ -1,7 +1,8 @@
+import { type Permission } from "@opengeni/contracts";
 import { type ApiRouteDeps } from "@opengeni/core";
 import type { SiteRuntimeHost } from "./runtime.js";
 import type { SiteRuntimeViewer } from "./viewer.js";
-export declare const SITE_AGENT_DEFAULTS_VERSION = 1;
+export declare const SITE_AGENT_DEFAULTS_VERSION = 2;
 /**
  * Before admitting more work, converge pre-redesign published-host sessions to
  * the same Site-local tools as a new conversation. This is a trusted host
@@ -13,4 +14,4 @@ export declare const SITE_AGENT_DEFAULTS_VERSION = 1;
  * audit event and completion marker atomic. Failed writes remain retryable.
  * Existing attempts keep their accepted execution policy; no turn is rewritten.
  */
-export declare function normalizeSiteAgentSession(deps: Pick<ApiRouteDeps, "db" | "settings" | "bus" | "objectStorage">, host: SiteRuntimeHost, viewer: SiteRuntimeViewer, sessionId: string, retainedToolIds: readonly string[]): Promise<void>;
+export declare function normalizeSiteAgentSession(deps: Pick<ApiRouteDeps, "db" | "settings" | "bus" | "objectStorage">, host: SiteRuntimeHost, viewer: SiteRuntimeViewer, sessionId: string, retainedToolIds: readonly string[], memberPermissions?: readonly Permission[]): Promise<void>;

package/dist/site-publishing/runtime.d.ts

@@ -7,8 +7,8 @@ import { type SiteRuntimeViewer } from "./viewer.js";
 /**
  * Site-runtime: the narrow API a Site gateway calls for one published Site
  * host, after the gateway signature passed. Everything here works for exactly
- * one Site: the host names it, the viewer is resolved for it, and the agent
- * principal is `site:<siteId>`.
+ * one Site: the host names it and the viewer is resolved for it. Members retain
+ * their human identity; outsiders use the viewer-bound `site:<siteId>` principal.
  */
 export type SiteRuntimeDeps = Pick<ApiRouteDeps, "db" | "settings" | "objectStorage">;
 export type SiteRuntimeHost = {
@@ -43,7 +43,7 @@ export declare function resolveSiteRuntimeViewer(deps: SiteRuntimeDeps, host: Si
     ignoreViewAs?: boolean;
 }): Promise<SiteRuntimeViewer>;
 /** What a viewer cannot do on a Site: 403 with `details.code` `not_available_for_viewer`. */
-export type SiteViewerFeature = "agent" | "agent_model" | "workspace_tools" | "site_data" | "site_sql";
+export type SiteViewerFeature = "agent" | "private_conversations" | "agent_model" | "workspace_tools" | "site_data" | "site_sql";
 export declare function siteNotAvailableForViewer(feature: SiteViewerFeature, message: string, extra?: Record<string, unknown>): import("../http/api-error.js").ApiHttpError;
 /** The viewer capabilities a page reads from `site.config` to hide what won't work. */
 export declare function siteViewerCapabilities(deps: SiteRuntimeDeps, host: SiteRuntimeHost, viewer: SiteRuntimeViewer, limits: SiteLimits): SiteViewerCapabilities;
@@ -160,9 +160,9 @@ export declare function meterSiteRuntime(deps: SiteRuntimeDeps, host: SiteRuntim
     viewer?: SiteRuntimeViewer;
 }): Promise<void>;
 /**
- * Run an ordinary session route in this process as the Site's service
- * principal (`site:<siteId>`), with a 60-second delegated token carrying only
- * session permissions and the viewer as its display label. The Site and the
+ * Run an ordinary session route in this process as the verified member, or
+ * the Site service principal for an outsider. The latter uses a 60-second
+ * delegated token plus the separate trusted viewer audience. The Site and the
  * served version ride along as the request's Site origin, so new sessions and
  * turns record where they came from. The route authorizes as usual.
  */
@@ -174,6 +174,7 @@ export declare function siteRuntimeSessionRequest(deps: SiteRuntimeDeps, host: S
     path: string;
     body?: unknown;
     extraPermissions?: readonly Permission[];
+    reauthorize: () => Promise<void>;
 }): Promise<Request>;
 /** A forwarded response without cookies (site-runtime never sets any). */
 export declare function siteRuntimeForwardedResponse(response: Response): Response;

package/dist/site-publishing/service.d.ts

@@ -1,6 +1,6 @@
 import { type ErrorCode, type Permission, type SiteHostMapRecord, type SiteHostnameAvailability, type SitePublication, type UpsertSitePublicationRequest } from "@opengeni/contracts";
 import type { AccessGrant } from "@opengeni/contracts";
-import { type ApiRouteDeps } from "@opengeni/core";
+import { type ApiRouteDeps, type cancelPublishedSiteSession } from "@opengeni/core";
 import { SitePublishingError, type PublishedSiteRecord, type SiteDataSite, type SiteHostnameEdgeState, type SitePublicationRecord, type SitePublishingScope, type StoredSiteLimitProfile } from "@opengeni/db";
 import { ApiHttpError } from "../http/api-error.js";
 import { type SiteContentScanner } from "./content-scanner.js";
@@ -40,13 +40,12 @@ export type SitePublishingEffects = {
 };
 /** Background effects running at once per process. */
 export declare const SITE_EFFECT_CONCURRENCY = 4;
+type SiteCancellation = (input: Parameters<typeof cancelPublishedSiteSession>[1]) => Promise<unknown>;
 /**
- * The app's in-process dispatch, registered with the site-runtime routes, so
- * publication changes can cancel a Site's conversations through the ordinary
- * session routes. Without it (the operator script) cancellation is skipped.
+ * Internal host lifecycle adapter. This never grants the Site service bearer
+ * ordinary session access and never impersonates a conversation's viewer.
  */
-export declare function setSitePublishingDispatch(settings: ApiRouteDeps["settings"], dispatch: (request: Request) => Promise<Response>): void;
-export declare function sitePublishingDispatch(settings: ApiRouteDeps["settings"]): ((request: Request) => Promise<Response>) | null;
+export declare function setSitePublishingCancellation(settings: ApiRouteDeps["settings"], cancel: SiteCancellation): void;
 type SitePublishingEffectsOptions = {
     fetch?: typeof fetch;
     backoffMs?: number;
@@ -164,11 +163,9 @@ export declare function siteServiceSessionRequest(deps: Pick<SitePublishingDeps,
  * Stop a Site's viewers after a takedown, unpublish or narrower access:
  * revoke every site-session now, and after commit cancel the Site's agent
  * conversations that may still be working (in-flight turns and queued
- * messages), as the Site itself through the ordinary control route. The
- * gateway refuses new work at once regardless: every site-runtime call
- * re-checks the publication. Without an in-process dispatch (the operator
- * script) the cancellation is skipped and logged; per-conversation caps
- * still bound what running turns can spend.
+ * messages), through the native cancel-only lifecycle adapter. The original
+ * actor survives queued background execution. No transcript access is granted.
+ * Every page is drained, including old conversations; there is no age cutoff.
  */
 export declare function stopSiteViewers(deps: SitePublishingDeps, scope: SitePublishingScope, siteId: string, options: {
     revokeSessions?: boolean;

package/dist/site-publishing/session-request-authority.d.ts

@@ -0,0 +1,3 @@
+export declare function bindSiteSessionRequestAuthority(request: Request, reauthorize: () => Promise<void>): void;
+/** Periodic SSE reauthorization must check the Site cookie, not only its delegate. */
+export declare function reauthorizeSiteSessionRequest(request: Request): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "3.2.2",
+  "version": "3.3.0",
   "description": "Opengeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -45,29 +45,29 @@
     "@keeper-security/secrets-manager-core": "17.6.0",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "3.2.2",
-    "@opengeni/artifact-tool": "3.2.2",
-    "@opengeni/capabilities": "3.2.2",
-    "@opengeni/codemode": "3.2.2",
-    "@opengeni/codex": "3.2.2",
-    "@opengeni/config": "3.2.2",
-    "@opengeni/contracts": "3.2.2",
-    "@opengeni/core": "3.2.2",
-    "@opengeni/db": "3.2.2",
-    "@opengeni/documents": "3.2.2",
-    "@opengeni/events": "3.2.2",
-    "@opengeni/github": "3.2.2",
-    "@opengeni/interaction": "3.2.2",
-    "@opengeni/network": "3.2.2",
-    "@opengeni/observability": "3.2.2",
-    "@opengeni/runtime": "3.2.2",
-    "@opengeni/storage": "3.2.2",
-    "@opengeni/tool-gateway": "3.2.2",
-    "@opengeni/vaults": "3.2.2",
-    "@opengeni/vaults-keeper": "3.2.2",
-    "@opengeni/vaults-onepassword": "3.2.2",
-    "@opengeni/vaults-protonpass": "3.2.2",
-    "@opengeni/xai-subscription": "3.2.2",
+    "@opengeni/agent-proto": "3.3.0",
+    "@opengeni/artifact-tool": "3.3.0",
+    "@opengeni/capabilities": "3.3.0",
+    "@opengeni/codemode": "3.3.0",
+    "@opengeni/codex": "3.3.0",
+    "@opengeni/config": "3.3.0",
+    "@opengeni/contracts": "3.3.0",
+    "@opengeni/core": "3.3.0",
+    "@opengeni/db": "3.3.0",
+    "@opengeni/documents": "3.3.0",
+    "@opengeni/events": "3.3.0",
+    "@opengeni/github": "3.3.0",
+    "@opengeni/interaction": "3.3.0",
+    "@opengeni/network": "3.3.0",
+    "@opengeni/observability": "3.3.0",
+    "@opengeni/runtime": "3.3.0",
+    "@opengeni/storage": "3.3.0",
+    "@opengeni/tool-gateway": "3.3.0",
+    "@opengeni/vaults": "3.3.0",
+    "@opengeni/vaults-keeper": "3.3.0",
+    "@opengeni/vaults-onepassword": "3.3.0",
+    "@opengeni/vaults-protonpass": "3.3.0",
+    "@opengeni/xai-subscription": "3.3.0",
     "@temporalio/client": "^1.17.0",
     "ajv": "^8.20.0",
     "better-auth": "^1.6.14",

package/src/access-grant-rls.ts

@@ -87,6 +87,7 @@ export async function withAccessGrantSessionRlsContext<T>(
           {
             subjectId: actor.subjectId,
             initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
+            agentRootSessionId: actor.callerRootSessionId,
             privateFileOwnerSubjectId:
               learning.defaultScope === "personal" ? learning.subjectId : null,
           },

package/src/http/sse.ts

@@ -7,6 +7,7 @@ import {
   getWorkspaceInteractionRevisionState,
   listSessionEventPage,
   listWorkspaceControlEvents,
+  getWorkspaceControlEvent,
   readSessionEventStorageGapEnd,
   type Database,
 } from "@opengeni/db";
@@ -677,7 +678,10 @@ export async function sseWorkspaceControlStream(
         }
       }
     }
-    await writeFrame(formatWorkspaceControlEventSse(event));
+    // The bus is workspace-wide, not an authorization projection. Re-read the
+    // exact durable row under this stream's actor before delivering live data.
+    const visible = await getWorkspaceControlEvent(db, workspaceId, event.id);
+    if (visible) await writeFrame(formatWorkspaceControlEventSse(visible));
     lastSent = event.sequence;
   };
   delivery = createLatestWinsDelivery(send, fail);

package/src/routes/browser-sessions.ts

@@ -151,6 +151,7 @@ import {
 import {
   requireAccessGrant,
   requireSessionAuthorization,
+  withSessionAuthorizationReadReuse,
   recordWorkspaceUsage,
   requireLimit,
   relayConfigFromSettings,
@@ -2834,6 +2835,7 @@ export function registerBrowserSessionRoutes(
           enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
         transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+        browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
         ...(deps.settings.agentOpStreamEnabled === true &&
         enrollment.opStream === true &&
         deps.bus.getOpStreamConnection
@@ -3157,16 +3159,40 @@ export function registerBrowserSessionRoutes(
     browserSessionId: string,
     authorizationOperation: SessionAuthorizationOperation,
     channelOperation: ChannelAOperation,
-    callback: (input: {
-      client: BrowserControlClient;
-      sessionClient: ReturnType<BrowserControlClient["sessionClient"]>;
-      record: BrowserSessionControlRecord;
-      binding: NonNullable<BrowserSessionControlRecord["session"]["controller"]>;
-      placement: BrowserPlacement;
-      sourceAuthorization: ResolvedSessionAuthorization | null;
-    }) => Promise<T>,
+    callback: ActiveBrowserControllerCallback<T>,
     recoverMissing = true,
     stages?: InteractionRouteStages,
+  ): Promise<T> {
+    // The source-session check and the machine-route check that follows it
+    // prove the same live agent attempt; they share those reads. Everything
+    // from the controller call onward reads fresh.
+    return await withSessionAuthorizationReadReuse((authorizationReads) =>
+      withActiveBrowserControllerReads(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        authorizationOperation,
+        channelOperation,
+        callback,
+        recoverMissing,
+        stages,
+        authorizationReads,
+      ),
+    );
+  }
+
+  async function withActiveBrowserControllerReads<T>(
+    context: Context,
+    grant: AccessGrant,
+    workspaceId: string,
+    browserSessionId: string,
+    authorizationOperation: SessionAuthorizationOperation,
+    channelOperation: ChannelAOperation,
+    callback: ActiveBrowserControllerCallback<T>,
+    recoverMissing: boolean,
+    stages: InteractionRouteStages | undefined,
+    authorizationReads: { handOffToToolDispatch(): void },
   ): Promise<T> {
     try {
       const record = await getBrowserSessionControlRecord(deps.db, {
@@ -3175,17 +3201,25 @@ export function registerBrowserSessionRoutes(
         browserSessionId,
       });
       stages?.mark("record");
-      const sourceAuthorization = await authorizeSourceSession(
-        deps,
-        grant,
-        record.sourceSessionId,
-        authorizationOperation,
-      );
+      // A Connected Machine (or any placement without a cached controller URL)
+      // always needs the source session; read it alongside authorization. A
+      // denial still wins, and the session is only used once authorized.
+      const sourceSessionNeeded =
+        record.session.placement?.kind === "connected_machine" ||
+        !record.controllerHostSandboxGroupId;
+      const [authorized, sourceRead] = await Promise.allSettled([
+        authorizeSourceSession(deps, grant, record.sourceSessionId, authorizationOperation),
+        sourceSessionNeeded
+          ? requireSourceSession(deps, workspaceId, record.sourceSessionId)
+          : Promise.resolve(null),
+      ]);
+      if (authorized.status === "rejected") throw authorized.reason;
+      if (sourceRead.status === "rejected") throw sourceRead.reason;
+      const sourceAuthorization = authorized.value;
       stages?.mark("authorize");
-      let sourceSession: Session | null = null;
+      let sourceSession: Session | null = sourceRead.value;
       if (record.session.placement?.kind === "connected_machine") {
-        sourceSession = await requireSourceSession(deps, workspaceId, record.sourceSessionId);
-        if (sourceSession.activeSandboxId !== record.session.placement.sandboxId) {
+        if (sourceSession?.activeSandboxId !== record.session.placement.sandboxId) {
           return await throwBrowserSourcePlacementChanged(
             grant,
             record.sourceSessionId,
@@ -3217,6 +3251,7 @@ export function registerBrowserSessionRoutes(
         placement: BrowserPlacement,
         provisionedClient?: BrowserControlClient,
       ): Promise<T> => {
+        authorizationReads.handOffToToolDispatch();
         // An active binding already proves browserd was provisioned. Reusing
         // it avoids restarting/checking the sidecar on every live input.
         const client = provisionedClient ?? connectController(deps, grant, record, placement);
@@ -4631,6 +4666,15 @@ async function settleBrowserRevisionCaptureFailure(
   });
 }
 
+type ActiveBrowserControllerCallback<T> = (input: {
+  client: BrowserControlClient;
+  sessionClient: ReturnType<BrowserControlClient["sessionClient"]>;
+  record: BrowserSessionControlRecord;
+  binding: NonNullable<BrowserSessionControlRecord["session"]["controller"]>;
+  placement: BrowserPlacement;
+  sourceAuthorization: ResolvedSessionAuthorization | null;
+}) => Promise<T>;
+
 async function requireSourceSession(
   deps: ApiRouteDeps,
   workspaceId: string,

package/src/routes/computer-sessions.ts

@@ -58,12 +58,14 @@ import {
   terminalizeStaleConnectedInteractionPlacement,
   touchComputerSessionController,
   type ComputerSessionControlRecord,
+  type EnrollmentRecord,
   type LeaseSnapshot,
 } from "@opengeni/db";
 import {
   hasPermission,
   requireAccessGrant,
   requireSessionAuthorization,
+  withSessionAuthorizationReadReuse,
   relayConfigFromSettings,
   resolveChannelAMachineConnection,
   resolveSessionSandboxRuntime,
@@ -125,7 +127,12 @@ import {
   observeComputerFrameEvidenceMismatch,
   observeLifecycleResult,
 } from "../interaction-metrics";
-import { withChannelA, withChannelARead, type ChannelAOperation } from "../sandbox/channel-a";
+import {
+  withChannelA,
+  withChannelARead,
+  type ChannelAHandle,
+  type ChannelAOperation,
+} from "../sandbox/channel-a";
 import { USER_CONTENT_SECURITY_HEADERS } from "../http/user-content";
 import { wrongInteractionPlacementMessage } from "./interaction-placement-message";
 import {
@@ -144,6 +151,14 @@ type ComputerPlacement = {
   screenControlAllowed?: boolean;
 };
 
+type ActiveComputerControllerCallback<T> = (input: {
+  client: BrowserControlClient;
+  sessionClient: ReturnType<BrowserControlClient["computerSessionClient"]>;
+  record: ComputerSessionControlRecord;
+  binding: NonNullable<ComputerSessionControlRecord["session"]["controller"]>;
+  placement: ComputerPlacement;
+}) => Promise<T>;
+
 const MODEL_COMPUTER_FRAME_MAX_BYTES = 256 * 1024;
 
 type ComputerFrameCaptureClient = {
@@ -1117,6 +1132,38 @@ export function registerComputerSessionRoutes(
     },
   );
 
+  async function routedMachineConnection(
+    handle: ChannelAHandle,
+    grant: AccessGrant,
+    sourceSession: Session,
+    sandboxId: string,
+  ): Promise<EnrollmentRecord | null> {
+    const machineAuthority = await handle.machineAuthority();
+    const sandbox = await getSandbox(
+      deps.db,
+      {
+        accountId: grant.accountId,
+        workspaceId: sourceSession.workspaceId,
+        subjectId: machineAuthority.subjectId,
+      },
+      sandboxId,
+    );
+    if (sandbox?.kind !== "selfhosted" || !sandbox.enrollmentId) {
+      throw new ComputerSessionStateError("Connected Machine placement is unavailable");
+    }
+    return await resolveChannelAMachineConnection(
+      deps.db,
+      {
+        accountId: grant.accountId,
+        workspaceId: sourceSession.workspaceId,
+        sessionId: sourceSession.id,
+        machineWorkspaceId: sandbox.workspaceId,
+        enrollmentId: sandbox.enrollmentId,
+      },
+      machineAuthority,
+    );
+  }
+
   async function withComputerPlacement<T>(
     sourceSession: Session,
     grant: AccessGrant,
@@ -1174,6 +1221,7 @@ export function registerComputerSessionRoutes(
           enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
         transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+        browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
         ...(deps.settings.agentOpStreamEnabled === true &&
         enrollment.opStream === true &&
         deps.bus.getOpStreamConnection
@@ -1237,33 +1285,15 @@ export function registerComputerSessionRoutes(
         const resolved = await handle.routingSession.prime();
         let screenControlAllowed = false;
         if (operation !== "computer.end" && resolved.kind === "selfhosted" && resolved.sandboxId) {
-          // Look the routed machine up as the routing did: an agent acts for
-          // the person who started its turn, so a personal (Only me) machine
-          // stays reachable, subject to that attempt's per-chat permission.
-          const machineAuthority = await handle.machineAuthority();
-          const sandbox = await getSandbox(
-            deps.db,
-            {
-              accountId: grant.accountId,
-              workspaceId: sourceSession.workspaceId,
-              subjectId: machineAuthority.subjectId,
-            },
-            resolved.sandboxId,
-          );
-          if (sandbox?.kind !== "selfhosted" || !sandbox.enrollmentId) {
-            throw new ComputerSessionStateError("Connected Machine placement is unavailable");
-          }
-          const enrollment = await resolveChannelAMachineConnection(
-            deps.db,
-            {
-              accountId: grant.accountId,
-              workspaceId: sourceSession.workspaceId,
-              sessionId: sourceSession.id,
-              machineWorkspaceId: sandbox.workspaceId,
-              enrollmentId: sandbox.enrollmentId,
-            },
-            machineAuthority,
-          );
+          // The request already resolved this machine's live runner when it
+          // pinned the route; otherwise look the routed machine up as the
+          // routing did: an agent acts for the person who started its turn, so
+          // a personal (Only me) machine stays reachable, subject to that
+          // attempt's per-chat permission.
+          const enrollment =
+            handle.pinnedMachine?.sandboxId === resolved.sandboxId
+              ? handle.pinnedMachine.enrollment
+              : await routedMachineConnection(handle, grant, sourceSession, resolved.sandboxId);
           if (!enrollment?.connectionInstanceId) {
             throw new ComputerSessionStateError("Connected Machine is unavailable");
           }
@@ -1476,14 +1506,37 @@ export function registerComputerSessionRoutes(
     computerSessionId: string,
     authorizationOperation: SessionAuthorizationOperation,
     channelOperation: ChannelAOperation,
-    callback: (input: {
-      client: BrowserControlClient;
-      sessionClient: ReturnType<BrowserControlClient["computerSessionClient"]>;
-      record: ComputerSessionControlRecord;
-      binding: NonNullable<ComputerSessionControlRecord["session"]["controller"]>;
-      placement: ComputerPlacement;
-    }) => Promise<T>,
+    callback: ActiveComputerControllerCallback<T>,
     recoverMissing = true,
+  ): Promise<T> {
+    // The source-session check and the machine-route check that follows it
+    // prove the same live agent attempt; they share those reads. Everything
+    // from the controller call onward reads fresh.
+    return await withSessionAuthorizationReadReuse((authorizationReads) =>
+      withActiveComputerControllerReads(
+        context,
+        grant,
+        workspaceId,
+        computerSessionId,
+        authorizationOperation,
+        channelOperation,
+        callback,
+        recoverMissing,
+        authorizationReads,
+      ),
+    );
+  }
+
+  async function withActiveComputerControllerReads<T>(
+    context: Context,
+    grant: AccessGrant,
+    workspaceId: string,
+    computerSessionId: string,
+    authorizationOperation: SessionAuthorizationOperation,
+    channelOperation: ChannelAOperation,
+    callback: ActiveComputerControllerCallback<T>,
+    recoverMissing: boolean,
+    authorizationReads: { handOffToToolDispatch(): void },
   ): Promise<T> {
     try {
       const record = await getComputerSessionControlRecord(deps.db, {
@@ -1491,11 +1544,20 @@ export function registerComputerSessionRoutes(
         workspaceId,
         computerSessionId,
       });
-      await authorizeSourceSession(deps, grant, record.sourceSessionId, authorizationOperation);
-      let sourceSession: Session | null = null;
+      // Only a cached managed controller can skip the source session; read it
+      // alongside authorization otherwise. A denial still wins.
+      const sourceSessionNeeded = record.session.placement?.kind !== "sandbox_group";
+      const [authorized, sourceRead] = await Promise.allSettled([
+        authorizeSourceSession(deps, grant, record.sourceSessionId, authorizationOperation),
+        sourceSessionNeeded
+          ? requireSourceSession(deps, workspaceId, record.sourceSessionId)
+          : Promise.resolve(null),
+      ]);
+      if (authorized.status === "rejected") throw authorized.reason;
+      if (sourceRead.status === "rejected") throw sourceRead.reason;
+      let sourceSession: Session | null = sourceRead.value;
       if (record.session.placement?.kind === "connected_machine") {
-        sourceSession = await requireSourceSession(deps, workspaceId, record.sourceSessionId);
-        if (sourceSession.activeSandboxId !== record.session.placement.sandboxId) {
+        if (sourceSession?.activeSandboxId !== record.session.placement.sandboxId) {
           return await throwComputerSourcePlacementChanged(
             grant,
             record.sourceSessionId,
@@ -1517,6 +1579,7 @@ export function registerComputerSessionRoutes(
         throw new ComputerSessionStateError("ComputerSession controller authority changed");
       }
       const run = async (placement: ComputerPlacement): Promise<T> => {
+        authorizationReads.handOffToToolDispatch();
         // The active controller binding is the provisioning fence. Live
         // input connects to it directly instead of re-ensuring the sidecar.
         const client = connectController(grant, record, placement);