@opengeni/api-router 3.2.2 → 3.3.0

package/src/routes/insights-usage.ts

@@ -1,6 +1,8 @@
 import {
   InsightsCallsResponse,
   InsightsUsageResponse,
+  InsightsSiteUsageQuery,
+  InsightsSiteUsageResponse,
   OrganizationInsightsCallsQuery,
   OrganizationInsightsUsageQuery,
   WorkspaceInsightsCallsQuery,
@@ -10,10 +12,12 @@ import type { AccessContext } from "@opengeni/contracts";
 import {
   accountScopedApiKeyWorkspaceAuthority,
   getInsightsUsage,
+  getInsightsSiteUsage,
   hasPermission,
   listInsightsCalls,
   requireAccessContext,
   requireAccessGrant,
+  siteViewerForGrant,
   type ApiRouteDeps,
   type InsightsQueryScope,
 } from "@opengeni/core";
@@ -221,6 +225,24 @@ export function registerInsightsUsageRoutes(app: Hono, deps: ApiRouteDeps): void
     });
   }
 
+  app.get("/v1/workspaces/:workspaceId/insights/sites", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const query = InsightsSiteUsageQuery.safeParse(insightsQueryParameters(c.req.queries()));
+    if (!query.success) throw new HTTPException(400, { message: "invalid Site Insights query" });
+    const viewer = await siteViewerForGrant(deps.db, grant);
+    const response = await insightsWithFriendlyTimeout(() =>
+      getInsightsSiteUsage(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        query: query.data,
+        viewerSubjectId: viewer.subjectId,
+      }),
+    );
+    c.header("cache-control", "private, no-store");
+    return c.json(InsightsSiteUsageResponse.parse(response));
+  });
+
   app.get("/v1/workspaces/:workspaceId/insights/usage", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");

package/src/routes/sessions.ts

@@ -30,7 +30,12 @@ import {
   SITE_FRAME_SESSION_CREATE_FIELDS,
   siteFrameBodyRefusal,
 } from "@opengeni/contracts/site-session-http";
-import { requireWorkspace, scheduledSessionIds } from "@opengeni/db";
+import {
+  requireWorkspace,
+  scheduledSessionIds,
+  currentSiteViewerRlsContext,
+  nestedPostgresSqlState,
+} from "@opengeni/db";
 import {
   currentSiteSessionOrigin,
   isVerifiedDelegatedHumanAuthorization,
@@ -329,6 +334,7 @@ import {
 } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import { SessionRetryConflictError } from "@opengeni/db";
+import { reauthorizeSiteSessionRequest } from "../site-publishing/session-request-authority";
 import {
   attachViewer,
   detachViewer,
@@ -761,7 +767,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       // nothing else: the session gets the minimal Site profile. Only the Site
       // itself, running its published agent as `site:<siteId>`, chooses tools.
       const siteOrigin = origin ?? currentSiteSessionOrigin();
-      if (siteOrigin && grant.subjectId !== `site:${siteOrigin.siteId}`) {
+      if (siteOrigin && currentSiteViewerRlsContext()?.siteId !== siteOrigin.siteId) {
         const refused = siteFrameBodyRefusal("sessions.create", "/sessions", payload);
         if (refused)
           return c.json(
@@ -778,6 +784,11 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
           siteId: siteOrigin.siteId,
           versionId: siteOrigin.versionId ?? null,
         });
+        // Ordinary Site viewers use native Only-me ownership. An agent preview
+        // inherits its parent's native visibility; the Site audience binding
+        // additionally restricts that execution to the parent's real owner.
+        if (grant.principalKind !== "agent_attempt")
+          (payload as Record<string, unknown>).visibility = "private";
       }
       const create = () =>
         createSessionForRequest(deps, grant, workspaceId, payload, authorization);
@@ -3597,6 +3608,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
         reauthorizeAfterMs:
           authorization?.reauthorizeAfterMs ?? SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
         reauthorize: async () => {
+          await reauthorizeSiteSessionRequest(c.req.raw);
           const freshGrant = await requireFreshAccessGrant(c, deps, workspaceId, "sessions:read");
           await requireSessionAuthorization(deps, freshGrant, {
             sessionId,
@@ -5671,7 +5683,10 @@ export function sessionTenancyHttpError(error: unknown): Error {
       retryable: false,
     });
   }
-  if (error instanceof SessionTenancyNotActivatedError) {
+  if (
+    error instanceof SessionTenancyNotActivatedError ||
+    nestedPostgresSqlState(error) === "P0793"
+  ) {
     return new ApiHttpError(409, {
       code: "conflict",
       message: "Only-me chats are not enabled for this organization.",
@@ -6552,7 +6567,10 @@ export function sessionCreateErrorResponse(c: Context, error: unknown): Response
       403,
     );
   }
-  if (error instanceof SessionTenancyNotActivatedError) {
+  if (
+    error instanceof SessionTenancyNotActivatedError ||
+    nestedPostgresSqlState(error) === "P0793"
+  ) {
     return c.json(
       {
         code: "SESSION_TENANCY_NOT_ACTIVATED",

package/src/routes/site-runtime.ts

@@ -1,5 +1,8 @@
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import {
+  ReasoningEffort,
+  LatencyMode,
+  permissionsRequiredByFirstPartyTools,
   DeleteSessionQueueItemRequest,
   EditSessionQueueItemRequest,
   matchSiteOperation,
@@ -30,6 +33,7 @@ import {
   type ToolRef,
 } from "@opengeni/contracts";
 import {
+  cancelPublishedSiteSession,
   withHostSessionUsageLimit,
   withSiteSessionOrigin,
   admissibleWorkspaceModel,
@@ -42,6 +46,7 @@ import {
   consumeSiteAuthCode,
   finishSiteRuntimeAdmission,
   withSiteRuntimeAdmission,
+  withSiteViewerRlsContext,
   createSiteAbuseReport,
   getSiteWorkspaceMemberPermissions,
   readSitePlatformUsage,
@@ -65,7 +70,6 @@ import {
   type SiteRuntimeConversationRecord,
 } from "@opengeni/db";
 import {
-  SITE_AGENT_DATA_TOOL_PERMISSIONS,
   siteAgentDataToolsForStart,
   siteAgentInstructions,
   sitePublishedDataViewer,
@@ -145,7 +149,7 @@ import {
   configuredSitesDomain,
   healSiteEdgeIfStale,
   notifySiteAbuse,
-  setSitePublishingDispatch,
+  setSitePublishingCancellation,
   siteHostMapRecord,
   sitePublishingError,
 } from "../site-publishing/service";
@@ -212,6 +216,9 @@ const CreateConversationRequest = z
   .object({
     initialMessage: z.string().trim().min(1).max(MESSAGE_MAX_CHARS),
     idempotencyKey: z.string().min(1).max(200).optional(),
+    model: z.string().min(1).optional(),
+    reasoningEffort: ReasoningEffort.optional(),
+    latencyMode: LatencyMode.optional(),
   })
   .passthrough();
 const SendMessageRequest = z
@@ -497,8 +504,8 @@ type RuntimeRequest = {
 export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
   const dispatch = async (request: Request): Promise<Response> =>
     await app.fetch(markLocalInternalDispatch(request));
-  // Publication changes cancel a Site's conversations through this dispatch.
-  setSitePublishingDispatch(deps.settings, dispatch);
+  // Lifecycle cancellation is a native internal command, never viewer dispatch.
+  setSitePublishingCancellation(deps.settings, (input) => cancelPublishedSiteSession(deps, input));
 
   const handler = async (context: Context): Promise<Response> => {
     const domain = configuredSitesDomain(deps.settings);
@@ -1232,7 +1239,7 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
     throw unsupported();
   };
 
-  /** The viewer's own agent conversations on this Site, run as `site:<siteId>`. */
+  /** The viewer's own conversations, with native member or viewer-bound outsider authority. */
   const sessions = async (
     request: RuntimeRequest,
     id: string,
@@ -1246,6 +1253,20 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
     // carries the Site and version headers the API's Site frame guard
     // validates; sessions and turns it starts record this Site and version.
     const siteOrigin = { siteId: host.site.id, title: host.site.title, versionId: host.versionId };
+    const reauthorizeViewer = async () => {
+      const liveHost = await requireServedSiteRuntimeHost(deps, host.domain, request.fields.host);
+      const liveViewer = await resolveSiteRuntimeViewer(deps, liveHost, request.fields);
+      if (
+        liveHost.site.id !== host.site.id ||
+        liveViewer.principal !== viewer.principal ||
+        liveViewer.kind !== viewer.kind ||
+        liveViewer.sessionId !== viewer.sessionId
+      )
+        throw siteNotAvailableForViewer(
+          "agent",
+          "This conversation is no longer available to this viewer",
+        );
+    };
     let pendingAdmission: { sessionId: string; admissionId: string } | undefined;
     const send = async (
       method: string,
@@ -1253,16 +1274,20 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
       body?: unknown,
       extraPermissions?: readonly Permission[],
     ) => {
+      await reauthorizeViewer();
       const execute = () =>
-        withSiteSessionOrigin(siteOrigin, async () =>
-          dispatch(
-            await siteRuntimeSessionRequest(deps, host, viewer, {
-              origin: url.origin,
-              method,
-              path,
-              ...(body === undefined ? {} : { body }),
-              ...(extraPermissions ? { extraPermissions } : {}),
-            }),
+        withSiteViewerRlsContext({ siteId: host.site.id, principal: viewer.principal }, () =>
+          withSiteSessionOrigin(siteOrigin, async () =>
+            dispatch(
+              await siteRuntimeSessionRequest(deps, host, viewer, {
+                origin: url.origin,
+                method,
+                path,
+                reauthorize: reauthorizeViewer,
+                ...(body === undefined ? {} : { body }),
+                ...(extraPermissions ? { extraPermissions } : {}),
+              }),
+            ),
           ),
         );
       const pending = pendingAdmission;
@@ -1344,6 +1369,11 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
       if (viewer.kind === "guest" || viewer.kind === "user")
         await requireSitePlatformOpen(deps, "guest_agent");
       const models = await siteViewerModels(host, viewer, limits);
+      if (input.model && !models.allowed.includes(input.model))
+        throw siteNotAvailableForViewer(
+          "agent_model",
+          "This model is not available to you on this Site",
+        );
       if (models.unavailable)
         throw siteNotAvailableForViewer(
           "agent_model",
@@ -1402,6 +1432,11 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
         }
       }
       // Settle the viewer's recent spend so the day budget sees it.
+      if (!repair && viewer.kind !== "member" && deps.settings.privacyOnlyMeAllowed === false)
+        throw siteNotAvailableForViewer(
+          "private_conversations",
+          "Private Site conversations are disabled by this deployment",
+        );
       for (const conversation of await listOwnedSiteRuntimeConversations(deps.db, host.scope, {
         siteId: host.site.id,
         viewerPrincipal: viewer.principal,
@@ -1455,7 +1490,9 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
         host.scope,
         host.site.id,
         viewer.kind,
+        viewer.kind === "member" ? (memberPermissions ?? []) : undefined,
       );
+      const dataToolPermissions = permissionsRequiredByFirstPartyTools(dataTools);
       // One transaction counts the start and reserves a per-turn estimate
       // against the visitor's and the Site's windows; only the funded allowance
       // becomes the session's usage limit, set in the create transaction. The
@@ -1491,15 +1528,14 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
       const body = {
         initialMessage: input.initialMessage,
         requestedSessionId,
+        ...(viewer.kind === "member" ? { visibility: "private" } : {}),
         startMode: "standard",
         agentAccess: "session",
         memoryScope: "off",
         rigId: null,
         // Only this Site's data tools; never management or workspace tools.
         firstPartyMcpTools: dataTools,
-        ...(dataTools.length > 0
-          ? { firstPartyMcpPermissions: [...SITE_AGENT_DATA_TOOL_PERMISSIONS] }
-          : {}),
+        ...(dataTools.length > 0 ? { firstPartyMcpPermissions: dataToolPermissions } : {}),
         agent: {
           capabilities: {
             from: "none",
@@ -1511,7 +1547,13 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
         // No sandbox: a Site's agent answers from the page and the Site's
         // data, with no shell or workspace files.
         sandboxBackend: "none",
-        ...(repair ? { model: repair.model } : models.default ? { model: models.default } : {}),
+        ...(repair
+          ? { model: repair.model }
+          : input.model || models.default
+            ? { model: input.model ?? models.default }
+            : {}),
+        ...(input.reasoningEffort === undefined ? {} : { reasoningEffort: input.reasoningEffort }),
+        ...(input.latencyMode === undefined ? {} : { latencyMode: input.latencyMode }),
         instructions: siteAgentInstructions(host, viewer, dataTools, agent.instructions),
         // Always explicit: an empty list means no workspace tools at all.
         tools: mcpTools,
@@ -1525,8 +1567,7 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
         },
         ...(input.idempotencyKey ? { idempotencyKey: `site-runtime:${requestedSessionId}` } : {}),
       };
-      const start = () =>
-        send("POST", base, body, dataTools.length > 0 ? SITE_AGENT_DATA_TOOL_PERMISSIONS : []);
+      const start = () => send("POST", base, body, dataToolPermissions);
       // Workspace members get no Site budget at all: their conversation is an
       // ordinary session under the workspace's normal limits, so no session
       // usage limit is stamped on it, whatever the Site's limits say.
@@ -1694,6 +1735,7 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
         viewer,
         conversation.sessionId,
         conversation.toolIds,
+        viewer.kind === "member" ? (memberPermissions ?? []) : undefined,
       );
       const usage = await settleSiteRuntimeSpend(deps, host, conversation);
       // Clear the stamped session cap before dropping the durable conversation

package/src/sandbox/channel-a.ts

@@ -43,6 +43,7 @@ import {
   SandboxPaidComputeAdmissionError,
   withSandboxProviderReadLock,
   type Database,
+  type EnrollmentRecord,
   type LeaseSnapshot,
 } from "@opengeni/db";
 import { appendAndPublishEvents, type EventBus } from "@opengeni/events";
@@ -207,6 +208,15 @@ export type ChannelAHandle = {
    * who started an agent's turn, or the calling person. Routes that look up
    * the routed machine again must use it rather than the raw caller grant. */
   machineAuthority: () => Promise<ChannelAMachineAuthority>;
+  /** For a machine-home request, the Connected Machine and live runner this
+   * request was pinned to under `machineAuthority`. The routing session fails
+   * rather than follow a changed pointer, so a route that resolved this same
+   * sandbox can use it instead of looking the machine up again. */
+  pinnedMachine: {
+    sandboxId: string;
+    sandboxWorkspaceId: string;
+    enrollment: EnrollmentRecord;
+  } | null;
   requestId: string;
 };
 
@@ -629,6 +639,7 @@ async function withChannelAOperation<T>(
     routed: EstablishedSandboxSession,
     lease: LeaseSnapshot | null,
     homeSession: ChannelASession,
+    pinnedMachine: ChannelAHandle["pinnedMachine"] = null,
   ): Promise<T> => {
     const emit = async (events: { type: string; payload: unknown }[]): Promise<void> => {
       await appendAndPublishEvents(
@@ -667,6 +678,7 @@ async function withChannelAOperation<T>(
       homeSession,
       routingSession,
       machineAuthority,
+      pinnedMachine,
       requestId,
     });
     // The direct request has accepted the result in memory. Finalize every
@@ -770,6 +782,7 @@ async function withChannelAOperation<T>(
           enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
         transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+        browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
         ...(settings.agentOpStreamEnabled === true &&
         enrollment?.opStream === true &&
         bus.getOpStreamConnection
@@ -812,7 +825,11 @@ async function withChannelAOperation<T>(
         },
         established,
       );
-      return await runEstablished(routed, null, established.session as ChannelASession);
+      return await runEstablished(routed, null, established.session as ChannelASession, {
+        sandboxId: sandbox.id,
+        sandboxWorkspaceId: originWorkspaceId,
+        enrollment,
+      });
     } catch (error) {
       observeChannelAOperationFailure(services, {
         workspaceId,

package/src/sandbox/metrics-ingestion.ts

@@ -843,6 +843,7 @@ export function helloRuntimeCapabilities(hello: Hello): Record<string, boolean>
     operationCpuQuota: caps.operationCpuQuota === true,
     transactionalFsWrite: caps.transactionalFsWrite === true,
     credentialRenew: caps.credentialRenew === true,
+    browserControlHttp: caps.browserControlHttp === true,
     screenControl: caps.consentedScreenControl === true,
     ...(caps.macPermissions ? enrollmentMacPermissionCapabilities(caps.macPermissions) : {}),
   };

package/src/site-frame-guard.ts

@@ -11,7 +11,7 @@ import {
   withSiteSessionOrigin,
   type ApiRouteDeps,
 } from "@opengeni/core";
-import { getSession } from "@opengeni/db";
+import { getSession, getSessionAuthorityProjection } from "@opengeni/db";
 import type { Context, Next } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { ApiHttpError } from "./http/api-error";
@@ -78,10 +78,19 @@ export function siteFrameGuard(deps: ApiRouteDeps) {
         throw new HTTPException(404, { message: "Unsupported Site session API path" });
     }
     if (match.sessionId !== null) {
+      const authority = await getSessionAuthorityProjection(
+        deps.db,
+        grant.workspaceId,
+        match.sessionId,
+      );
       const session = await getSession(deps.db, grant.workspaceId, match.sessionId).catch(
         () => null,
       );
-      if (!session || !siteOriginsMatch(origin, siteSessionOriginFromMetadata(session.metadata)))
+      if (
+        !authority?.siteAccessRootId ||
+        !session ||
+        !siteOriginsMatch(origin, siteSessionOriginFromMetadata(session.metadata))
+      )
         throw new HTTPException(404, { message: "session not found" });
     }
     if (c.req.method !== "GET" && match.operation.id !== "sessions.create") {

package/src/site-publishing/agent-data-tools.ts

@@ -1,10 +1,12 @@
 import {
   siteHostname,
+  permissionsRequiredByFirstPartyTools,
   type FirstPartyMcpToolName,
+  type Permission,
   type SiteLimitProfileKind,
 } from "@opengeni/contracts";
 import { resolveFirstPartyMcpToolPolicy } from "@opengeni/config";
-import type { ApiRouteDeps } from "@opengeni/core";
+import { hasPermission, type ApiRouteDeps } from "@opengeni/core";
 import {
   consumeSiteRuntimeRate,
   findSiteRuntimeAgentConversation,
@@ -47,12 +49,6 @@ export const SITE_AGENT_MEMBER_SQL_TOOLS = Object.freeze([
   "site_sql_query",
 ] as const satisfies readonly FirstPartyMcpToolName[]);
 
-/** The first-party permissions those tools need (Site Data writes need publish). */
-export const SITE_AGENT_DATA_TOOL_PERMISSIONS = Object.freeze([
-  "artifacts:read",
-  "artifacts:publish",
-] as const);
-
 export const SITE_AGENT_OTHER_SITE_MESSAGE = "This Site's assistant can only use this Site's data";
 export const SITE_AGENT_MANAGEMENT_MESSAGE =
   "This Site's assistant can use the Site's data, not manage the Site";
@@ -64,13 +60,23 @@ export function siteAgentDataToolNames(input: {
   siteSql: boolean;
   /** The deployment's first-party tool allowlist. */
   allowed: readonly string[];
+  /** Live member ceiling; omitted only where the native caller filters tools itself. */
+  memberPermissions?: readonly Permission[];
 }): FirstPartyMcpToolName[] {
   const names: FirstPartyMcpToolName[] = [
     ...SITE_AGENT_DATA_TOOLS,
     ...(input.siteSql ? SITE_AGENT_SQL_TOOLS : []),
     ...(input.siteSql && input.viewerKind === "member" ? SITE_AGENT_MEMBER_SQL_TOOLS : []),
   ];
-  return names.filter((name) => input.allowed.includes(name));
+  return names.filter(
+    (name) =>
+      input.allowed.includes(name) &&
+      (input.viewerKind !== "member" ||
+        input.memberPermissions === undefined ||
+        permissionsRequiredByFirstPartyTools([name]).every((permission) =>
+          hasPermission(input.memberPermissions!, permission),
+        )),
+  );
 }
 
 /** Whether Site SQL is offered on this deployment and turned on for the Site. */
@@ -90,11 +96,13 @@ export async function siteAgentDataToolsForStart(
   scope: { accountId: string; workspaceId: string },
   siteId: string,
   viewerKind: SiteRuntimeConversationViewerKind,
+  memberPermissions?: readonly Permission[],
 ): Promise<FirstPartyMcpToolName[]> {
   return siteAgentDataToolNames({
     viewerKind,
     siteSql: await siteAgentSiteSqlOn(deps, scope, siteId),
     allowed: resolveFirstPartyMcpToolPolicy(deps.settings).allowed,
+    ...(memberPermissions === undefined ? {} : { memberPermissions }),
   });
 }
 

package/src/site-publishing/agent-session.ts

@@ -1,11 +1,16 @@
-import { resolveAgentConfig, type SessionToolPolicy, type ToolRef } from "@opengeni/contracts";
+import {
+  permissionsRequiredByFirstPartyTools,
+  resolveAgentConfig,
+  type Permission,
+  type SessionToolPolicy,
+  type ToolRef,
+} from "@opengeni/contracts";
 import { agentConfigDeploymentPolicy, resolveFirstPartyMcpToolPolicy } from "@opengeni/config";
 import { siteSessionOriginFromMetadata, type ApiRouteDeps } from "@opengeni/core";
 import { appendSessionEventsWithLockedSessionUpdate, getSiteSqlDatabase } from "@opengeni/db";
 import { publishDurableSessionEvents } from "@opengeni/events";
 import {
   resolveSiteAgentDataContext,
-  SITE_AGENT_DATA_TOOL_PERMISSIONS,
   siteAgentDataToolNames,
   siteAgentInstructions,
 } from "./agent-data-tools";
@@ -14,7 +19,7 @@ import type { SiteRuntimeViewer } from "./viewer";
 import { sitePublishingError } from "./service";
 import { siteSqlOffered } from "../site-sql/gateway";
 
-export const SITE_AGENT_DEFAULTS_VERSION = 1;
+export const SITE_AGENT_DEFAULTS_VERSION = 2;
 
 /**
  * Before admitting more work, converge pre-redesign published-host sessions to
@@ -33,6 +38,7 @@ export async function normalizeSiteAgentSession(
   viewer: SiteRuntimeViewer,
   sessionId: string,
   retainedToolIds: readonly string[],
+  memberPermissions?: readonly Permission[],
 ): Promise<void> {
   const data = await resolveSiteAgentDataContext(deps, host.scope, sessionId);
   if (
@@ -55,7 +61,9 @@ export async function normalizeSiteAgentSession(
     viewerKind: viewer.kind,
     siteSql: sqlEnabled,
     allowed: resolveFirstPartyMcpToolPolicy(deps.settings).allowed,
+    ...(memberPermissions === undefined ? {} : { memberPermissions }),
   });
+  const dataToolPermissions = permissionsRequiredByFirstPartyTools(dataTools);
   const config = resolveAgentConfig({
     creator: "api",
     request: {
@@ -83,7 +91,12 @@ export async function normalizeSiteAgentSession(
     (session) => {
       if (
         session.parentSessionId ||
-        session.createdBy.subjectId !== `site:${host.site.id}` ||
+        (session.createdBy.subjectId !== `site:${host.site.id}` &&
+          !(
+            viewer.kind === "member" &&
+            session.createdBy.kind === "subject" &&
+            session.createdBy.subjectId === viewer.subjectId
+          )) ||
         siteSessionOriginFromMetadata(session.metadata)?.siteId !== host.site.id
       )
         throw sitePublishingError(
@@ -97,7 +110,12 @@ export async function normalizeSiteAgentSession(
         raw && typeof raw === "object" && !Array.isArray(raw)
           ? (raw as Record<string, unknown>)
           : {};
-      if (stamp.agentDefaultsVersion === SITE_AGENT_DEFAULTS_VERSION) return { events: [] };
+      if (
+        stamp.agentDefaultsVersion === SITE_AGENT_DEFAULTS_VERSION &&
+        session.firstPartyMcpTools.join(",") === dataTools.join(",") &&
+        session.firstPartyMcpPermissions?.join(",") === dataToolPermissions.join(",")
+      )
+        return { events: [] };
       // Never restore workspace defaults or add a newly declared connector to
       // an old conversation. Preserve only its still-authorized exact refs.
       const allowed = new Set(["opengeni", ...retainedToolIds]);
@@ -126,7 +144,7 @@ export async function normalizeSiteAgentSession(
         ],
         update: {
           firstPartyMcpTools: dataTools,
-          firstPartyMcpPermissions: [...SITE_AGENT_DATA_TOOL_PERMISSIONS],
+          firstPartyMcpPermissions: dataToolPermissions,
           agentConfig: config,
           instructions,
           tools,

package/src/site-publishing/runtime.ts

@@ -9,7 +9,11 @@ import {
   type SiteLimits,
   type SiteViewerCapabilities,
 } from "@opengeni/contracts";
-import { sessionUsageLimitsProducerEnabled, type ApiRouteDeps } from "@opengeni/core";
+import {
+  sessionUsageLimitsProducerEnabled,
+  stampSiteViewerSessionAuthorization,
+  type ApiRouteDeps,
+} from "@opengeni/core";
 import {
   consumeSiteRuntimeRate,
   findSiteHostname,
@@ -40,6 +44,7 @@ import {
   type SiteRuntimeReservation,
 } from "@opengeni/db";
 import type { SiteGatewayFields } from "./gateway-signature";
+import { bindSiteSessionRequestAuthority } from "./session-request-authority";
 import { effectiveSiteLimits, siteViewerLimits, sourceSiteLimitProfile } from "./limits";
 import {
   siteLimitInputs,
@@ -59,8 +64,8 @@ import {
 /**
  * Site-runtime: the narrow API a Site gateway calls for one published Site
  * host, after the gateway signature passed. Everything here works for exactly
- * one Site: the host names it, the viewer is resolved for it, and the agent
- * principal is `site:<siteId>`.
+ * one Site: the host names it and the viewer is resolved for it. Members retain
+ * their human identity; outsiders use the viewer-bound `site:<siteId>` principal.
  */
 
 export type SiteRuntimeDeps = Pick<ApiRouteDeps, "db" | "settings" | "objectStorage">;
@@ -219,6 +224,7 @@ export async function resolveSiteRuntimeViewer(
 /** What a viewer cannot do on a Site: 403 with `details.code` `not_available_for_viewer`. */
 export type SiteViewerFeature =
   | "agent"
+  | "private_conversations"
   | "agent_model"
   | "workspace_tools"
   | "site_data"
@@ -796,9 +802,9 @@ export async function meterSiteRuntime(
 // --- in-process dispatch ------------------------------------------------------------
 
 /**
- * Run an ordinary session route in this process as the Site's service
- * principal (`site:<siteId>`), with a 60-second delegated token carrying only
- * session permissions and the viewer as its display label. The Site and the
+ * Run an ordinary session route in this process as the verified member, or
+ * the Site service principal for an outsider. The latter uses a 60-second
+ * delegated token plus the separate trusted viewer audience. The Site and the
  * served version ride along as the request's Site origin, so new sessions and
  * turns record where they came from. The route authorizes as usual.
  */
@@ -812,14 +818,30 @@ export async function siteRuntimeSessionRequest(
     path: string;
     body?: unknown;
     extraPermissions?: readonly Permission[];
+    reauthorize: () => Promise<void>;
   },
 ): Promise<Request> {
-  return await siteServiceSessionRequest(
+  const request = await siteServiceSessionRequest(
     deps,
     host.scope,
     { id: host.site.id, versionId: host.versionId },
     { ...input, label: `${siteRuntimeViewerLabel(viewer)} on ${host.hostname}` },
   );
+  bindSiteSessionRequestAuthority(request, input.reauthorize);
+  if (viewer.kind === "member" && viewer.subjectId && viewer.sessionId) {
+    // The gateway already verified the host and opaque Site cookie. Native
+    // resolution reloads this person's live membership, roles and models.
+    // This is delegated ownership, never fabricated managed-cookie proof.
+    stampSiteViewerSessionAuthorization(request, {
+      organizationId: host.scope.accountId,
+      subjectId: viewer.subjectId,
+      permissions: [
+        ...new Set([...SITE_RUNTIME_AGENT_PERMISSIONS, ...(input.extraPermissions ?? [])]),
+      ],
+      workspaceId: host.scope.workspaceId,
+    });
+  }
+  return request;
 }
 
 /** A forwarded response without cookies (site-runtime never sets any). */